H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SynAck](https://attack.mitre.org/software/S0242) is variant of Trojan ransomware targeting mainly English-speaking users since at least fall 2017. (Citation: SecureList SynAck Doppelgänging May 2018) (Citation: Kaspersky Lab SynAck May 2018)

Labels

malware

14 recorded

Relationships

uses

to Clear Windows Event Logs

Technique

uses

to Data Encrypted for Impact

Technique

uses

to File and Directory Discovery

Technique

uses

to Modify Registry

Technique

uses

to Native API

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Process Doppelgänging

Technique

uses

to Query Registry

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

4 external

References

mitre-attack

S0242

open

SynAck

—

SecureList SynAck Doppelgänging May 2018

https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/

open

Kaspersky Lab SynAck May 2018

https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging

open