VerdaCrypt Ransomware: Analysis of the PowerShell-Based Cryptoviral Extortion Tool

VerdaCrypt represents a sophisticated PowerShell-based ransomware that combines advanced encryption techniques with psychological manipulation to extort victims. Employing a modular architecture with anti-analysis capabilities, this ransomware targets critical data across multiple file types with AES-256 encryption. The threat actor behind VerdaCrypt, self-identified as the “Kugutsushi subdivision,” uses philosophically-framed extortion messages and demands payment through cryptocurrency. This analysis examines VerdaCrypt’s technical implementation, distribution vectors, targeted file types, and provides comprehensive mitigation strategies for organizations to protect against this evolving threat.

Introduction to VerdaCrypt Ransomware

VerdaCrypt is a newly discovered ransomware variant that represents a concerning evolution in PowerShell-based malware. First identified in April 2025, this ransomware combines sophisticated encryption techniques with advanced anti-analysis capabilities and psychological manipulation tactics. What sets VerdaCrypt apart from other ransomware families is its modular architecture, philosophical framing of extortion demands, and comprehensive targeting of sensitive data types.

The ransomware identifies itself as a product of the “Kugutsushi subdivision,” a previously undocumented threat actor. Unlike many ransomware strains that focus solely on encryption speed, VerdaCrypt prioritizes stealth, persistence, and psychological impact, making it particularly dangerous to targeted organizations.

This analysis is based on the examination of a PowerShell script named “Verdacrypt-Z.ps1” and related intelligence gathered from security researchers and incident response teams. The threat demonstrates both technical sophistication and social engineering expertise, positioning it as a significant concern for organizations across multiple sectors.

Technical Features of VerdaCrypt Ransomware

VerdaCrypt exhibits several advanced technical characteristics that make it particularly effective and difficult to detect or mitigate:

• PowerShell-based implementation: The ransomware is primarily written in PowerShell, allowing it to operate without dropping traditional executable files that might trigger antivirus detection.
• Modular architecture: VerdaCrypt employs a modular design with separate components for core functionality, persistence, encryption, anti-detection, propagation, and payload delivery, allowing the threat actors to easily update or customize specific capabilities.
• Hybrid encryption system: Uses AES-256 for file encryption with RSA-2048 for key protection, making decryption without the attacker’s private key mathematically infeasible.
• Comprehensive targeting: The ransomware targets over 100 different file extensions across multiple categories including documents, media files, archives, database files, and development files.
• Shadow copy elimination: Before beginning encryption, VerdaCrypt systematically deletes Windows Volume Shadow Copies to prevent easy recovery of files.
• Anti-analysis techniques: The ransomware includes sophisticated capabilities to detect virtual machines, sandbox environments, and security tools, with different evasion behaviors based on the environment detected.
• Cross-process operation: VerdaCrypt can inject itself into legitimate Windows processes like explorer.exe and svchost.exe to evade detection and maintain persistence.
• Multi-stage propagation: The ransomware attempts to spread via USB drives using autorun.inf and LNK file exploitation techniques.

One of the most notable aspects of VerdaCrypt is its active disabling of security features. The ransomware attempts to disable Windows Defender, Windows Firewall, and other security protections through registry modifications and service tampering, significantly increasing the risk of successful encryption if executed with administrative privileges.

Targeted File Types and Encryption Strategy

VerdaCrypt casts an extraordinarily wide net in terms of targeted file types, focusing on maximum impact across various data types that might be valuable to victims. The ransomware targets over 100 different file extensions across multiple categories:

The encryption process follows a sophisticated methodology:

1. File discovery: The ransomware scans multiple directories, including user profiles, cloud storage locations, application data, and development environments to locate valuable files.
2. Key generation: For each infection, VerdaCrypt generates a unique AES-256 key and a secure initialization vector (IV).
3. Batch processing: Files are encrypted in batches to optimize performance, with the potential for parallel encryption on multi-core systems.
4. In-place encryption: Rather than creating new files, the ransomware encrypts files in-place and then changes their extension to “.verdant”.
5. Key protection: The AES key used for file encryption is itself encrypted using RSA-2048, ensuring that only the attackers’ private key can unlock the files.

The encryption routine includes checks to avoid encrypting files already in use by the system, which helps the ransomware maintain stealth by not crashing the operating system during encryption. This selective approach coupled with the wide range of targeted file types maximizes the likelihood of encrypting critical user data.

Distribution and Infection Methods

VerdaCrypt employs multiple sophisticated distribution techniques to reach its targets. Based on the analysis of the PowerShell script and related intelligence, the following primary infection vectors have been identified:

• Phishing campaigns: Carefully crafted emails containing the PowerShell script as an attachment or links to download the script from compromised or attacker-controlled websites.
• Living-off-the-land techniques: The ransomware may be deployed using legitimate PowerShell features, potentially bypassing application whitelisting and other security controls.
• Supply chain compromises: Evidence suggests possible distribution through compromised software updates or packages to target specific organizations.
• Remote access exploitation: Targeting of exposed RDP, VPN, or other remote access services to manually deploy the ransomware within compromised networks.

Once executed, VerdaCrypt demonstrates a comprehensive approach to establishing persistence:

1. Registry modifications: Creates autorun keys in multiple registry locations to survive system reboots.
2. Scheduled tasks: Establishes scheduled tasks with multiple triggers to ensure consistent execution even if some are discovered and removed.
3. WMI event subscriptions: Creates persistent WMI event subscriptions that trigger the ransomware when specific system events occur.
4. DLL hijacking: Attempts to perform DLL hijacking on certain system libraries if administrative privileges are obtained.
5. Process injection: Injects malicious code into legitimate processes like explorer.exe and svchost.exe to evade detection.

A particularly concerning aspect of VerdaCrypt is its attempt to spread within networks and via removable media:

• USB propagation: Creates hidden copies of itself on USB drives, along with malicious LNK files designed to appear as legitimate folders like “Documents” or “Photos” to trick users into executing the ransomware.
• Autorun exploitation: Places autorun.inf files on USB drives to automatically launch when connected to vulnerable systems.
• Network scanning: Searches for open network shares to encrypt remote files and potentially spread to other systems.

These distribution and persistence techniques demonstrate a level of sophistication typically associated with advanced threat actors, suggesting that VerdaCrypt may be operated by an experienced cybercriminal group with significant technical expertise.

Ransom Demands and Threat Actor Behavior

One of the most distinctive aspects of VerdaCrypt is its ransom note, which differs from typical ransomware in both style and content. The ransom note titled “!!!_READ_ME_!!!.txt” employs sophisticated language and philosophical framing to manipulate victims:

This ransom note reveals several key insights about the threat actor:

• Sophisticated psychological tactics: The use of philosophical terminology and concepts creates an intellectual framing that attempts to normalize the extortion and position the attackers as sophisticated operators rather than criminals.
• Double-extortion strategy: The threat of data dissemination (“phased data dissemination protocol”) suggests the ransomware may also exfiltrate data before encryption, enabling additional leverage through threatened leaks.
• Organizational structure: The reference to “Kugutsushi subdivision” implies a structured criminal organization with different operational units, potentially indicating a larger threat actor ecosystem.
• Operational security focus: The instructions to use Protonmail for secure communications and warnings against forensic analysis demonstrate sophisticated operational security practices.

Rather than specifying a fixed ransom amount in the initial note, VerdaCrypt’s operators require victims to establish contact first, allowing for dynamic pricing based on the victim’s perceived ability to pay. This negotiation-based approach is increasingly common among sophisticated ransomware operations, maximizing profits by tailoring demands to each victim’s circumstances.

The Kugutsushi subdivision referenced in the note appears to be a new or previously undocumented threat actor, with no public reports linking them to other known ransomware operations as of April 2025. The name “Kugutsushi” has Japanese origins, potentially referring to puppet masters or manipulators, though this cultural reference may be deliberate misdirection rather than an indication of the attackers’ actual nationality or identity.

Technical Indicators of Compromise

Organizations should monitor for the following indicators that may suggest a VerdaCrypt infection or attack in progress:

File System Artifacts

Registry Modifications

Process and Command Line Indicators

Network Indicators

YARA Rules for Comprehensive VerdaCrypt Detection

The following enhanced YARA rules provide multiple detection strategies for VerdaCrypt Ransomware components:

Basic PowerShell Script Detection

Ransom Note Detection

Advanced Encryption Component Detection

Anti-Analysis and Evasion Techniques Detection

Privilege Escalation Detection

Security Feature Disabling Detection

Propagation Methods Detection

Memory-Based Detection for Running Processes

Usage Recommendations

These YARA rules should be used as part of a defense-in-depth strategy:

• Deploy the PowerShell script detection rule for file-based detection on endpoints and email gateways
• Implement the ransom note detection rule for early identification of successful infections
• Use the anti-analysis, privilege escalation, and security disabling rules for behavioral detection
• Apply the memory-based rule for runtime detection of active VerdaCrypt processes
• Combine multiple rules in a comprehensive detection policy to increase detection probability

Organizations should adapt these rules to their specific environments, adding any organization-specific exclusions to reduce false positives while maintaining detection capabilities.

Enhanced Mitigation and Protection Strategies

Based on our comprehensive analysis of VerdaCrypt’s code and behavior, we recommend these specific defensive measures:

PowerShell Security Controls

• Enable PowerShell Logging:
  • Enable Script Block Logging with Set-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Type DWord -Value 1
  • Enable Module Logging with New-Item -Path "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Force and New-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 1 -Force
  • Enable Protected Event Logging to prevent tampering with logs
• Constrained Language Mode: Deploy PowerShell in Constrained Language Mode by setting the environment variable $env:__PSLockdownPolicy = 4 or using AppLocker to enforce CLM
• Just Enough Administration (JEA): Implement JEA configurations to limit PowerShell capabilities to only what is necessary for legitimate administrative tasks
• AMSI Integration: Ensure your security solutions are integrated with AMSI to detect malicious scripts before execution

Defense Against VerdaCrypt’s Specific Evasion Techniques

• UAC Bypass Mitigation:
  • Set UAC to “Always notify” through Group Policy
  • Monitor registry paths commonly used for UAC bypass (e.g., HKCU:\Software\Classes\ms-settings\shell\open\command)
  • Implement Protected Administrator accounts that require credential re-entry
• Anti-Analysis Countermeasures:
  • Deploy deception technology that simulates analysis environments to trigger malware’s evasion behavior
  • Implement memory-based detection to identify evasion attempts
  • Monitor for suspicious system property queries commonly used for sandbox detection
• Security Feature Protection:
  • Enable Tamper Protection in Windows Defender
  • Use Group Policy to lock down security settings and prevent modifications
  • Implement Security Center monitoring for disabled security features

Preventing VerdaCrypt’s Propagation Methods

• USB Protection:
  • Disable autorun functionality with reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoAutorun" /t REG_DWORD /d 1 /f
  • Implement device control solutions to restrict USB usage to authorized devices only
  • Deploy endpoint security that scans removable media before allowing access
• Network Segmentation:
  • Implement VLAN segmentation to isolate critical systems
  • Use host-based firewalls to restrict SMB traffic between endpoints
  • Implement privileged access workstations for administrative tasks
• Credential Protection:
  • Use credential guard to protect against token theft and pass-the-hash attacks
  • Implement time-based access tokens with short expiration periods
  • Apply the principle of least privilege to limit administrative account usage

Recovery Preparedness Specific to VerdaCrypt

• Shadow Copy Protection:
  • Create and maintain offline backups that VerdaCrypt cannot access
  • Implement shadow copy protection with tools that monitor and prevent deletion commands
  • Use backup solutions that require separate authentication from domain credentials
• File Recovery Strategy:
  • Maintain versioned backups to recover files from before the encryption
  • Implement a 3-2-1 backup strategy (3 copies, 2 different media, 1 offsite)
  • Regularly test backup restoration processes in isolated environments
• Incident Response Plan:
  • Develop a ransomware-specific incident response playbook
  • Conduct tabletop exercises to practice the response to a VerdaCrypt infection
  • Establish isolated communication channels for use during a ransomware incident

Code Analysis: Key Features of VerdaCrypt’s PowerShell Implementation

The PowerShell implementation of VerdaCrypt reveals several sophisticated programming techniques that contribute to its effectiveness:

Modular Architecture

VerdaCrypt’s code is highly modular, with distinct functional components:

This modular design allows the ransomware to:

• Selectively deploy only the components needed for a specific environment
• Update individual modules without changing the entire codebase
• Customize behavior based on target characteristics
• Hide its full capabilities by loading modules only when needed

Advanced Error Handling

VerdaCrypt implements sophisticated error handling to ensure operational continuity even when specific functions fail:

This sophisticated error handling ensures that:

• The ransomware continues operating even when specific functions encounter errors
• Failed operations trigger alternative approaches rather than terminating execution
• Evidence of failed attempts is removed to avoid detection
• Detailed error information is logged for the attackers but not exposed in ways that facilitate analysis

Dynamic Code Execution

VerdaCrypt makes extensive use of PowerShell’s dynamic code execution capabilities:

These dynamic execution techniques allow VerdaCrypt to:

• Evade static analysis by assembling code at runtime
• Hide its true functionality until execution
• Bypass security controls that rely on signature-based detection
• Adapt its behavior based on the environment it discovers during execution

Conclusion

VerdaCrypt represents a sophisticated evolution in PowerShell-based ransomware, combining advanced technical capabilities with psychological manipulation tactics designed to maximize victim compliance. Its modular architecture, comprehensive anti-analysis features, and multiple persistence mechanisms make it a significant threat to organizations across various sectors.

Key characteristics that distinguish VerdaCrypt include:

• A fully PowerShell-based implementation that reduces the detection footprint
• Sophisticated encryption approach targeting over 100 file types across multiple categories
• Comprehensive security disabling capabilities when run with administrative privileges
• Multiple propagation methods including USB drives and network scanning
• Philosophical framing of extortion demands to manipulate victims psychologically

Organizations can protect themselves by implementing defense-in-depth strategies with specific focus on PowerShell security, maintaining robust offline backups, implementing access controls that follow the principle of least privilege, and developing comprehensive incident response plans. As ransomware continues to evolve, maintaining vigilance and implementing proactive security measures remains the most effective approach to mitigating these sophisticated threats.

VerdaCrypt should be considered a high-priority threat due to its technical sophistication and the comprehensive nature of its attack capabilities. Security teams should implement the detection and mitigation strategies outlined in this analysis to protect their organizations from this emerging threat.