How to Identify a Ransomware Family
When ransomware hits, naming the strain early points you at the right public guidance — containment steps, recovery advice, and whether a free decryptor exists. This guide shows responders how to read the markers during triage, and, just as important, how to verify an identification rather than guess. Identifying the family is investigative work, not attribution certainty.
In plain words
Identifying a ransomware family means reading the markers left behind — the ransom note filename and branding, the encrypted-file extension, the contact and onion addresses, and the observable TTPs — and then verifying them against identification services before you name anything. PlayCISO has a free, browser-based ransom-note interpreter that helps surface those markers during triage.
The markers are a lead, never proof. Affiliates reuse and rebrand builders, and attackers sometimes impersonate known names, so attribution from a note alone is uncertain. Confirm with ID Ransomware, No More Ransom and vendor or CISA writeups — and always verify independently before acting on the name.
Step by step
- 1
Preserve a sample before you touch anything
Before you investigate, protect the evidence. Keep a copy of the ransom note file, one or two small encrypted files (not sensitive ones), and any attacker contact details exactly as found. Work from copies on an isolated system, record where each artifact came from, and avoid renaming or re-encrypting files. If you later submit to an identification service, you want the originals intact — and if a decryptor exists, you will need unmodified encrypted samples to use it.
- 2
Read the ransom note — filename, content and branding
The note is usually the richest single marker. Capture its filename (families drop distinctively named notes, and the pattern itself is a signal), the on-screen or wallpaper branding, the tone and the specific wording. Note any group name the attackers use for themselves and whether the note points to a data-leak site. Treat the self-identified name as a claim to verify, not a fact — affiliates reuse builders and attackers sometimes impersonate better-known brands.
- 3
Record the encrypted-file extension and rename pattern
Note how files were renamed: appended extensions, prefixes, or a per-victim identifier embedded in the name. Some families append a consistent extension; others append a victim-specific string, and some leave the original name untouched. Record the exact pattern across several files, because a shared or static extension can point toward a family while a random one tells you the pattern is per-infection — useful either way, but only as one input among several.
- 4
Collect contact and onion addresses
Pull every contact channel from the note: email addresses, Tox IDs, qTox handles, Session IDs, and .onion URLs for the negotiation or leak portal. These can be distinctive, but handle them carefully — do not visit attacker infrastructure from a corporate or attributable connection, and never contact the attackers as part of identification. Record the addresses as evidence and let the verification services and vendor writeups do the matching.
- 5
Note the TTPs and timeline you can observe
Identification is stronger when the behaviour matches the name. Capture what you can see: initial access vector, lateral movement, whether volume shadow copies were deleted, whether data was exfiltrated before encryption (double extortion), and any tooling or living-off-the-land commands in your logs. Families and the affiliates who deploy them have documented habits, but TTPs overlap heavily and are reused across groups, so treat a behavioural match as corroboration, not proof.
- 6
Verify with identification services — do not guess
This is the step that turns a guess into evidence. Upload the ransom note and an encrypted sample to ID Ransomware (by MalwareHunterTeam) and run the note or a sample through No More Ransom’s Crypto Sheriff at https://www.nomoreransom.org. These services match against large signature sets and tell you when the markers are ambiguous. Use the least-sensitive sample files you can, and confirm your organisation permits uploading them before you do.
- 7
Check for a known free decryptor
Once a family is suggested, check whether a free, legitimate decryptor exists — No More Ransom hosts a decryption-tools catalogue, and several vendors publish their own. A working decryptor is both relief and strong confirmation of the family. Only ever use decryptors from the official No More Ransom project or a named reputable vendor; tools offered on forums or by the attackers can carry additional malware or corrupt your files.
- 8
Cross-reference vendor and CISA writeups
Corroborate the identification against independent, reputable sources: CISA advisories (including the #StopRansomware series), the FBI/CISA joint advisories, and vendor threat-intel writeups. Compare the note wording, extension, contact format and TTPs you recorded against the documented indicators. Agreement across several independent sources is what lets you report a family with confidence — and the same sources give you the specific containment, recovery and reporting guidance to follow next.
Paste a ransom note into the interactive interpreter to surface the markers that matter — filename, extension, contact format and branding — and get pointed toward the right verification services. It never contacts attackers or uploads anything on your behalf.
Related
The interactive note analyzer this guide walks you through — read the markers, then verify.
Ransomware payment decisionWork through the pay-or-not decision with the legal, ethical and operational factors laid out.
Ransomware readiness scorecardScore how prepared your organisation is to detect, contain and recover from an attack.
IR playbook labBuild and rehearse the incident-response playbook that triage like this feeds into.
Breach indexBrowse documented incidents to see how real ransomware events unfolded and were handled.
All PlayCISO toolsThe full set of free, browser-based scanners, calculators and decision aids for security leaders.
Frequently asked questions
Can I identify the ransomware family from the ransom note alone?
The note is a strong lead but not proof. Attackers reuse leaked or purchased builders, affiliates deploy the same strain under different brands, and some groups deliberately impersonate better-known names. A note tells you what the attacker wants you to believe; only matching it against identification services and independent writeups turns that lead into a confident identification. Always verify before you report a family.
Which services should I use to verify?
ID Ransomware by MalwareHunterTeam and No More Ransom’s Crypto Sheriff (https://www.nomoreransom.org) are the standard starting points — you submit the note and an encrypted sample and they match against large signature sets. Corroborate the result with CISA advisories, FBI/CISA joint advisories and reputable vendor threat-intel writeups before you treat the family as confirmed.
What markers actually distinguish one family from another?
The most useful are the ransom note filename and wording, the appended or prefixed file extension and rename pattern, the contact channels (email, Tox, Session, .onion portals), and the observed TTPs. Names like LockBit, BlackCat/ALPHV, Cl0p, Akira, Play, Black Basta, Royal, Phobos/Dharma and STOP/Djvu are examples of what those marker sets can look like — but every one of those indicators can overlap with or be imitated by another group, so no single marker is conclusive.
Why is attribution from markers uncertain?
Ransomware is largely an affiliate business. One codebase is operated by many different affiliates, builders and source code leak and get reused, and groups rebrand, split and merge — Royal and Black Basta, for instance, have documented lineage from earlier operations. So the same extension or note can appear across unrelated intrusions, and a confident-looking marker can be a reused or impersonated one. Treat identification as investigative, corroborated across sources, not as certain attribution of who attacked you.
Is it safe to contact the attackers to confirm the family?
No. Never contact attacker infrastructure or negotiation portals as part of identification, and avoid visiting their .onion sites from an attributable connection. Contact and negotiation, if they happen at all, are decisions for incident-response leadership, legal counsel and often law enforcement — not an identification step. Record the addresses as evidence and let the verification services do the matching.
What should I do once I think I have identified the family?
Use the identification to pull the right guidance, not to jump to payment. Check No More Ransom and reputable vendors for a free decryptor, follow the containment and recovery steps in the relevant CISA #StopRansomware advisory, preserve evidence, and report the incident to law enforcement per your jurisdiction. The family name is a key that unlocks the correct playbook — the response itself still runs through your incident-response process.