H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

SamSam

[SamSam](https://attack.mitre.org/software/S0370) is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.(Citation: US-CERT SamSam 2018)(Citation: Talos SamSam Jan 2018)(Citation: Sophos SamSam Apr 2018)(Citation: Symantec SamSam Oct 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[SamSam](https://attack.mitre.org/software/S0370) is ransomware that appeared in early 2016. Unlike some ransomware, its variants have required operators to manually interact with the malware to execute some of its core components.(Citation: US-CERT SamSam 2018)(Citation: Talos SamSam Jan 2018)(Citation: Sophos SamSam Apr 2018)(Citation: Symantec SamSam Oct 2018)

Labels

malware
5 recorded

Relationships

uses
to Data Encrypted for Impact
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File Deletion
Technique
uses
to Junk Code Insertion
Technique
uses
to Windows Command Shell
Technique
6 external

References

mitre-attack
S0370
open
Sophos SamSam Apr 2018
https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf
open
Samas
—
Symantec SamSam Oct 2018
https://www.symantec.com/blogs/threat-intelligence/samsam-targeted-ransomware-attacks
open
US-CERT SamSam 2018
https://www.us-cert.gov/ncas/alerts/AA18-337A
open
Talos SamSam Jan 2018
https://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance