S0242: SynAck

SynAck is a Windows Trojan ransomware variant documented by ATT&CK as targeting mainly English-speaking users since at least fall 2017. The business issue is not just malware identification; the mapped behaviors show a ransomware workflow that can profile the host, inspect services, processes, files, registry and language settings, use stealth such as process doppelgänging and obfuscation, modify or clear Windows evidence, and encrypt data for impact.

Executive priority

Treat this as a ransomware readiness validation case for Windows estates. Leaders should ask whether backups, recovery decision-making, endpoint visibility, centralized logging, and incident response playbooks can withstand ransomware that performs discovery and attempts to impair evidence. It is also a useful audit and resilience test: can the organization prove it collects the right Windows telemetry and can recover critical data if endpoint logs are cleared or files are encrypted?

Technical view

SOC and IR teams should validate coverage for the ATT&CK relationships tied to SynAck: service, process, system, user, file/directory, registry, and language discovery; registry modification; Native API usage; obfuscated files or information; process doppelgänging; Windows event log clearing; and data encryption for impact. Because ATT&CK provides no official detection text for this software object, detection should be behavior-led rather than signature-only, with special attention to Windows endpoint sequences that combine discovery, stealth/process manipulation, registry activity, log clearing, and high-volume file modification.

Likely telemetry

Windows endpoint process creation and command-line telemetry for discovery utilities and unusual parent/child process chains
Registry query and registry modification events
Windows Event Log clearing or audit log interruption events
File system telemetry showing rapid enumeration, rename, write, or encryption-like modification patterns
Service and process enumeration evidence

Detection direction

Build detections around behavior chains rather than SynAck name alone, since the object has no official ATT&CK detection guidance.
Correlate discovery activity with registry changes, process manipulation indicators, log clearing, and mass file modification to reduce noise.
Tune for false positives from legitimate administration, inventory, backup, software deployment, and troubleshooting tools that enumerate services, processes, files, or registry keys.
Treat Windows Event Log clearing as high-value context, especially when near ransomware-like file activity or suspicious process execution.
Account for sandbox and analysis blind spots because the mapped behaviors include system checks and system language discovery, which can alter malware behavior in test environments.

Mitigation priorities

Prioritize resilient, tested backups and recovery procedures for systems where data availability is business-critical.
Centralize and protect Windows logs so local log clearing does not remove incident evidence.
Restrict unnecessary administrative privileges that enable registry modification and event log clearing.
Harden endpoint prevention and monitoring around suspicious process manipulation, obfuscated payloads, and unauthorized registry changes.
Use ransomware tabletop and recovery exercises to confirm escalation paths, business impact decisions, and evidence collection responsibilities.

Additional notes and limits

The supplied ATT&CK relationships make SynAck useful as a ransomware behavior model: discovery-heavy pre-impact activity, stealth/process manipulation, registry interaction, evidence impairment, and data encryption for impact. The SecureList and Kaspersky references support the SynAck ransomware and process doppelgänging context, but local telemetry is required to determine exposure or detection quality.

ATT&CK lists the malware platform as Windows and provides no official detection text, no aliases, no labels, and no object-level tactics. This summary does not assert active exploitation, attribution, prevalence, or guaranteed detection. Control recommendations are defensive priorities inferred from the supplied ATT&CK fields and relationships, not vendor-specific fixes.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SynAck

SynAck is variant of Trojan ransomware targeting mainly English-speaking users since at least fall 2017. [1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques14 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1083	File and Directory Discovery	SynAck checks its directory location in an attempt to avoid launching in a sandbox.[1][2]
Enterprise	T1112	Modify Registry	SynAck can manipulate Registry keys.[1]
Enterprise	T1027	Obfuscated Files or Information	SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.[1][2]
Enterprise	T1033	System Owner/User Discovery	SynAck gathers user names from infected hosts.[1]
Enterprise	T1497.001	System ChecksSub-technique	SynAck checks its directory location in an attempt to avoid launching in a sandbox.[1][2]
Enterprise	T1082	System Information Discovery	SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.[1]
Enterprise	T1055.013	Process DoppelgängingSub-technique	SynAck abuses NTFS transactions to launch and conceal malicious processes.[1][2]
Enterprise	T1106	Native API	SynAck parses the export tables of system DLLs to locate and call various Windows API functions.[1][2]
Enterprise	T1012	Query Registry	SynAck enumerates Registry keys associated with event logs.[1]
Enterprise	T1486	Data Encrypted for Impact	SynAck encrypts the victims machine followed by asking the victim to pay a ransom. [1]
Enterprise	T1007	System Service Discovery	SynAck enumerates all running services.[1][2]
Enterprise	T1685.005	Clear Windows Event LogsSub-technique	SynAck clears event logs.[1]
Enterprise	T1614.001	System Language DiscoverySub-technique	SynAck lists all the keyboard layouts installed on the victim’s system using `GetKeyboardLayoutList` API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.[1]
Enterprise	T1057	Process Discovery	SynAck enumerates all running processes.[1][2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.3
Created: Oct 17, 2018, 00:14 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:42 UTC (UTC+00:00)
Raw hash: 287a9c134a7dd7a2...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.3	Apr 25, 2025, 14:42 UTC (UTC+00:00)	Current bundle	`287a9c134a7d…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[2]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[3]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[4]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[5]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[6]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[7]
SynAck
(Citation: SecureList SynAck Doppelgänging May 2018) (Citation: Kaspersky Lab SynAck May 2018)
[8]
SynAck
(Citation: SecureList SynAck Doppelgänging May 2018) (Citation: Kaspersky Lab SynAck May 2018)
[9]
SynAck
(Citation: SecureList SynAck Doppelgänging May 2018) (Citation: Kaspersky Lab SynAck May 2018)
[10]
mitre-attackS0242
Open source URL
[11]
mitre-attackS0242
Open source URL
[12]
mitre-attackS0242
Open source URL
[13]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[14]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[15]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[16]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[17]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[18]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[19]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[20]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[21]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[22]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[23]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[24]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[25]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[26]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[27]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[28]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[29]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[30]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[31]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[32]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[33]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[34]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[35]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[36]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[37]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[38]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[39]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[40]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[41]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[42]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[43]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[44]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[45]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[46]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[47]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[48]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[49]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[50]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[51]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[52]
Kaspersky Lab SynAck May 2018
Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
Open source URL
[53]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL
[54]
SecureList SynAck Doppelgänging May 2018
Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use