LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0457: Netwalker

Netwalker is fileless ransomware written in PowerShell and executed directly in memory.[1]

EnterpriseS0457MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Netwalker matters because ATT&CK describes it as Windows fileless ransomware written in PowerShell and executed directly in memory. For leaders, the practical issue is not only ransomware impact; it is whether the organization can see and contain script-based, in-memory execution before encryption, service disruption, or recovery inhibition becomes a business-continuity event.

Executive priority

Prioritize validation of Windows endpoint visibility, PowerShell governance, recovery resilience, and incident-response playbooks. The related ATT&CK behaviors include execution through PowerShell, command shell, WMI, native APIs, and services; stealth through obfuscation, embedded payloads, decoding, and DLL injection; discovery of systems and security software; tool transfer and lateral movement; and impact through data encryption, service stopping, and inhibition of recovery. Executives should ask whether SOC and IR teams can produce evidence for these stages quickly, whether backups and recovery mechanisms are protected from endpoint-level tampering, and whether ransomware tabletop exercises include fileless and in-memory tradecraft.

Technical view

For SOC, detection engineering, and IR teams, treat this as a Windows ransomware behavior cluster centered on PowerShell and memory-resident execution. Validate collection and alerting for suspicious PowerShell execution, obfuscated command lines, WMI activity, cmd.exe usage, service-control abuse, registry modification, DLL or process injection indicators, tool transfer, lateral file movement, security-tool discovery or impairment, service stops, recovery inhibition, and file encryption activity. Because the ATT&CK object provides no official detection text, coverage should be proven through local telemetry tests, rule logic review, and incident-response evidence requirements rather than assumed from product capability.

Likely telemetry

  • Windows process creation events with full command line for powershell.exe, cmd.exe, sc.exe, net.exe, reg.exe, WMI-related processes, and service execution paths
  • PowerShell script block, module, transcription, and engine logs where enabled
  • WMI activity logs and remote/local WMI execution traces
  • Endpoint telemetry for memory injection, DLL loading, reflective or in-memory execution indicators, and Native API-related process behavior
  • Windows service creation, modification, start, stop, and disable events

Detection direction

  • Confirm Windows endpoint logging captures command lines and PowerShell content sufficiently to analyze obfuscation rather than relying only on executable names.
  • Tune detections for suspicious combinations: PowerShell or cmd spawning WMI/service-control activity, registry changes, tool transfer, security-tool discovery, or recovery inhibition commands.
  • Correlate stealth behaviors such as embedded payloads, command obfuscation, deobfuscation, and DLL injection with later ransomware-impact behaviors instead of treating each signal in isolation.
  • Review false positives from legitimate administration: WMI, PowerShell, service control, and registry modification are common admin behaviors, so detections should use context such as parent process, user, host role, timing, encoded or obfuscated content, and unusual fan-out.
  • Validate alerting for service stops, security-tool impairment, and recovery-control deletion as high-priority ransomware precursors or impact-stage events.

Mitigation priorities

  • Harden and monitor PowerShell use on Windows, including policy, logging, and restrictions appropriate to administrative need.
  • Limit administrative pathways that enable WMI, service execution, registry modification, and remote command execution to authorized users and managed systems.
  • Protect endpoint security tools, logging agents, and recovery services from disablement or unauthorized modification.
  • Segment and monitor internal file transfer paths to reduce unchecked lateral tool movement.
  • Maintain resilient backups and recovery processes that are separated from ordinary endpoint administrative control and regularly tested for restoration.
Additional notes and limits

The ATT&CK object identifies Netwalker as fileless PowerShell ransomware executed in memory and links it to multiple techniques spanning execution, stealth, discovery, lateral movement, defense impairment, and impact. The most useful defensive value is to map those relationships into a Windows ransomware detection and response validation plan, especially around PowerShell, WMI, service control, registry activity, memory execution, and recovery protection.

MITRE provides no official detection guidance for this object, no aliases, and no explicit tactics on the malware object itself. The platform supplied for the malware is Windows; broader platforms listed on related techniques should not be interpreted as Netwalker platform support without additional evidence. Local environment data is required to determine actual exposure, control coverage, and detection quality.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Netwalker

Netwalker is fileless ransomware written in PowerShell and executed directly in memory.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1112Modify Registry

Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE\{8 random characters}.[1]

EnterpriseT1685Disable or Modify Tools

Netwalker can detect and terminate active security software-related processes on infected systems.[1][2]

EnterpriseT1082System Information Discovery

Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.[1]

EnterpriseT1570Lateral Tool Transfer

Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.[2]

EnterpriseT1027.010Command ObfuscationSub-technique

Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.[1][2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Netwalker can detect and terminate active security software-related processes on infected systems.[1]

EnterpriseT1027.009Embedded PayloadsSub-technique

Netwalker's DLL has been embedded within the PowerShell script in hex format.[1]

EnterpriseT1490Inhibit System Recovery

Netwalker can delete the infected system's Shadow Volumes to prevent recovery.[1][2]

EnterpriseT1059.001PowerShellSub-technique

Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.[1][2]

EnterpriseT1106Native API

Netwalker can use Windows API functions to inject the ransomware DLL.[1]

EnterpriseT1486Data Encrypted for Impact

Netwalker can encrypt files on infected machines to extort victims.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.[2]

EnterpriseT1047Windows Management Instrumentation

Netwalker can use WMI to delete Shadow Volumes.[1]

EnterpriseT1489Service Stop

Netwalker can terminate system processes and services, some of which relate to backup software.[1]

EnterpriseT1105Ingress Tool Transfer

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.[2]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1570: Lateral Tool TransferEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1027.009: Embedded PayloadsEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
eaea9820bbf91bab...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundleeaea9820bbf9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  2. [2]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  3. [3]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  4. [4]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  5. [5]
    mitre-attackS0457
    Open source URL
  6. [6]
    mitre-attackS0457
    Open source URL
  7. [7]
    mitre-attackS0457
    Open source URL
  8. [8]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  9. [9]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  10. [10]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  11. [11]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  12. [12]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  13. [13]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  14. [14]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  15. [15]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  16. [16]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  17. [17]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  18. [18]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  19. [19]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  20. [20]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  21. [21]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  22. [22]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  23. [23]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  24. [24]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  25. [25]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  26. [26]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  27. [27]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  28. [28]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  29. [29]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  30. [30]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  31. [31]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  32. [32]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  33. [33]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  34. [34]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  35. [35]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  36. [36]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  37. [37]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  38. [38]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  39. [39]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  40. [40]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  41. [41]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  42. [42]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  43. [43]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
  44. [44]
    Sophos Netwalker May 2020

    Szappanos, G., Brandt, A.. (2020, May 27). Netwalker ransomware tools give insight into threat actor. Retrieved May 27, 2020.

    Open source URL
  45. [45]
    TrendMicro Netwalker May 2020

    Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use