LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0618: FIVEHANDS

FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT.[1][2]

EnterpriseS0618MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

FIVEHANDS is a Windows ransomware family described by ATT&CK as a customized C++ version of DEATHRANSOM, observed since at least 2021 and used in Ransomware-as-a-Service campaigns. Its mapped behaviors matter because they span execution, discovery of files and network shares, obfuscation/deobfuscation, encryption for impact, and inhibition of recovery—areas that directly determine whether an organization can contain an intrusion before business disruption.

Executive priority

Treat this object as a ransomware-readiness validation case. Leaders should ask whether Windows endpoint monitoring, WMI/script execution visibility, network share governance, backup resilience, and recovery controls are evidenced and tested—not just documented. The business decision value is in confirming that SOC and IR teams can see pre-impact discovery and recovery-inhibition behavior early enough to act, and that recovery options are protected from the same Windows environment being encrypted.

Technical view

For SOC, detection engineering, and IR teams, validate coverage around the ATT&CK relationships: WMI execution (T1047), command/script interpreter activity (T1059), file and directory discovery (T1083), network share discovery (T1135), encrypted or encoded files and deobfuscation behavior (T1027.013, T1140), data encryption for impact (T1486), and inhibition of system recovery (T1490). Because ATT&CK provides no official detection text for FIVEHANDS, detections should be behavior-led and environment-tuned rather than family-name dependent.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • WMI activity, including local or remote execution context where collected
  • File system enumeration and high-volume file modification or encryption indicators
  • Network share access and discovery evidence, especially SMB share activity on Windows networks
  • Signals of encoded/encrypted artifacts or runtime deobfuscation on hosts

Detection direction

  • Correlate execution telemetry with discovery activity against local files, directories, and network shares; isolated discovery commands may be administrative, but discovery followed by broad file modification is higher-risk.
  • Validate WMI monitoring quality, including command content, parent/child process context, user context, and remote execution visibility where available.
  • Tune for ransomware impact patterns such as rapid file writes/renames/encryption across local and shared paths, while accounting for legitimate bulk administrative or backup operations.
  • Monitor recovery-inhibition attempts as urgent signals because they affect incident recovery options, even before encryption is widespread.
  • Do not rely only on static malware naming: ATT&CK notes obfuscation/encoding and deobfuscation behaviors, so behavioral detections are important when signatures are bypassed or artifacts change.

Mitigation priorities

  • Prioritize tested, protected, and access-controlled backups and recovery procedures, since mapped behavior includes data encryption and inhibition of recovery.
  • Restrict and monitor administrative execution paths such as WMI and command/script interpreters according to least privilege and operational need.
  • Reduce unnecessary network share exposure and validate permissions on shared folders and drives to limit encryption blast radius.
  • Ensure Windows endpoint logging and centralized retention are sufficient for IR reconstruction of execution, discovery, share access, and recovery-control changes.
  • Run ransomware tabletop or technical validation exercises that prove SOC escalation, containment, backup restoration, and evidence preservation workflows.
Additional notes and limits

This take is based on the supplied ATT&CK software object, its official description, external references, and listed technique relationships. The most useful defensive framing is not the malware name alone, but the mapped behavior chain: execute, discover local/shared data, evade simple inspection through encoding/decoding, encrypt data, and impair recovery.

ATT&CK does not provide official detection guidance, aliases, labels, or object-level tactics for FIVEHANDS in the supplied fields. Local validation is required to determine whether these behaviors are visible in the organization’s Windows telemetry and whether detections are reliable in the presence of legitimate administration and backup activity.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FIVEHANDS

FIVEHANDS is a customized version of DEATHRANSOM ransomware written in C++. FIVEHANDS has been used since at least 2021, including in Ransomware-as-a-Service (RaaS) campaigns, sometimes along with SombRAT.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

8 rows
DomainIDNameRelationship / procedure
EnterpriseT1047Windows Management Instrumentation

FIVEHANDS can use WMI to delete files on a target machine.[1][3]

EnterpriseT1059Command and Scripting Interpreter

FIVEHANDS can receive a command line argument to limit file encryption to specified directories.[1][2]

EnterpriseT1135Network Share Discovery

FIVEHANDS can enumerate network shares and mounted drives on a network.[2]

EnterpriseT1083File and Directory Discovery

FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.[3][2]

EnterpriseT1486Data Encrypted for Impact

FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.[1][3][2]

EnterpriseT1490Inhibit System Recovery

FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.[1][3]

EnterpriseT1140Deobfuscate/Decode Files or Information

FIVEHANDS has the ability to decrypt its payload prior to execution.[1][3][2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

The FIVEHANDS payload is encrypted with AES-128.[1][3][2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1059: Command and Scripting InterpreterEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
34de1fe8a108bf4a...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle34de1fe8a108…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  2. [2]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  3. [3]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  4. [4]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  5. [5]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  6. [6]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  7. [7]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  8. [8]
    mitre-attackS0618
    Open source URL
  9. [9]
    mitre-attackS0618
    Open source URL
  10. [10]
    mitre-attackS0618
    Open source URL
  11. [11]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  12. [12]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  13. [13]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  14. [14]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  15. [15]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  16. [16]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  17. [17]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  18. [18]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  19. [19]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  20. [20]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  21. [21]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  22. [22]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  23. [23]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  24. [24]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  25. [25]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  26. [26]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  27. [27]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  28. [28]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  29. [29]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  30. [30]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  31. [31]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  32. [32]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  33. [33]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  34. [34]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  35. [35]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  36. [36]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  37. [37]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  38. [38]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  39. [39]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  40. [40]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  41. [41]
    CISA AR21-126A FIVEHANDS May 2021

    CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.

    Open source URL
  42. [42]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  43. [43]
    FireEye FiveHands April 2021

    McLellan, T. and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.

    Open source URL
  44. [44]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
  45. [45]
    NCC Group Fivehands June 2021

    Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use