Ransom:Win32/NetWalker

Detected by Microsoft Defender Antivirus

Aliases: No associated aliases

Summary

The NetWalker ransomware, also known as Mailto, first emerged in August 2019. This ransomware encrypts the data on your disk and can stop you from using your device or accessing your data. It encrypts files, renders them inaccessible, and demands payment for the decryption key.

The authors of this ransomware distribute it as a ransomware as a service (RaaS) that allows other operators to modify and deploy custom versions of it. Recent attacks deploying this ransomware have affected corporate networks and have involved ransom demands of up to US$100,000. Publicly available reports indicate that apart from encrypting data, the operators of this ransomware also threaten disclosure of stolen data if payments are not made.

NetWalker is typically deployed during human-operated ransomware campaigns. Attackers target large enterprises using the following methods:

Email messages with a malicious attachment
Network compromise through vulnerabilities and other exposures
Exposed Remote Desktop Protocol (RDP) services

Once a user inadvertently runs the malicious attachment or operators deploy the ransomware executable, NetWalker performs various tasks before eventually encrypting multiple files.

For information about NetWalker and other human-operated ransomware campaigns, read these blog posts:

Human-operated ransomware attacks: A preventable disaster

Microsoft works with healthcare organizations to protect from popular ransomware during COVID-19 crisis: Here’s what to do

Ransomware groups continue to target healthcare, critical services; here’s how to reduce risk

There is no one-size-fits-all response if you have been targeted by ransomware. To recover files, you can restore backups. There is no guarantee that paying the ransom will give you access to your files.

Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.

You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.