GIBCRYPTO Destructive Ransomware with Snake Keylogger Shared Telegram C2 Infrastructure

Key facts for GIBCRYPTO destructive ransomware

Detection coverage for GIBCRYPTO destructive ransomware

As of 2026-03-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0210 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GIBCRYPTO Telegram Bot API C2 Exfiltration — C2 Phase

Detects GIBCRYPTO command-and-control communication via Telegram Bot API. The malware exfiltrates victim data (usernames, machine names, screenshots) to a Telegram channel. This same infrastructure is shared with Snake Keylogger campaigns, making Telegram Bot API traffic from non-browser processes a critical indicator.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1102.002, T1567
• Data sources: proxy, firewall, microsoft_defender_for_endpoint, dns
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="bluecoat" OR sourcetype="squid" OR sourcetype="pan:traffic" OR sourcetype="fortigate_traffic" (url="*api.telegram.org/bot*" OR url="*api.telegram.org/bot*/sendMessage*" OR url="*api.telegram.org/bot*/sendPhoto*" OR url="*api.telegram.org/bot*/sendDocument*" OR cs_host="api.telegram.org") NOT (src_process="chrome.exe" OR src_process="firefox.exe" OR src_process="msedge.exe" OR src_process="Telegram.exe") | eval detection_phase="c2", threat="GIBCRYPTO" | stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(src_ip) as source_ips values(src_process) as processes by src_host | where count >= 1 | table src_host, first_seen, last_seen, count, urls, source_ips, processes

Microsoft KQL

let timeframe = 24h;
let telegram_c2 = DeviceNetworkEvents
    | where Timestamp > ago(timeframe)
    | where RemoteUrl has "api.telegram.org/bot"
       or RemoteUrl has "api.telegram.org"
    | where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "Telegram.exe", "Teams.exe", "slack.exe")
    | project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
let dns_telegram = DeviceEvents
    | where Timestamp > ago(timeframe)
    | where ActionType == "DnsQueryResponse"
    | where AdditionalFields has "api.telegram.org"
    | project Timestamp, DeviceName, AccountName, AdditionalFields;
union telegram_c2, dns_telegram
| summarize EventCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), URLs=make_set(RemoteUrl), Processes=make_set(InitiatingProcessFileName) by DeviceName, AccountName
| project DeviceName, AccountName, FirstSeen, LastSeen, EventCount, URLs, Processes

Sigma

title: GIBCRYPTO Telegram Bot API C2 Communication from Non-Browser Process
id: a1b2c3d4-0210-4003-b003-aabbccdd0007
status: experimental
description: Detects outbound HTTPS connections to api.telegram.org from non-browser processes, indicative of GIBCRYPTO ransomware or Snake Keylogger C2 data exfiltration via Telegram Bot API.
references:
    - https://labs.k7computing.com/index.php/gibcrypto-the-destructive-ransomware-with-a-snake-keylogger-connection/
    - https://intel.threadlinqs.com/threats/TL-2026-0210
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-03-11
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102.002
    - attack.exfiltration
    - attack.t1567
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains: 'api.telegram.org/bot'
    filter_browsers:
        c-process|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\Telegram.exe'
    condition: selection and not filter_browsers
falsepositives:
    - Legitimate IT automation scripts using Telegram bots for alerting
    - Custom internal applications leveraging Telegram Bot API for notifications
level: high

Known false positives:

• Legitimate IT automation scripts using Telegram bots for alerting
• Custom internal applications leveraging Telegram Bot API for notifications

Tuning notes: Allowlist known IT automation servers that use Telegram bots for monitoring alerts. Consider blocking api.telegram.org at the firewall for environments that do not use Telegram. Correlate with .gibcrypto file events or AMSI bypass for confirmed GIBCRYPTO attribution.

• 🔒 GIBCRYPTO .NET Execution with Zeroed PE Timestamp — Exploitation Phase · unlock with TL Creds
• 🔒 GIBCRYPTO Registry Persistence and MBR Corruption — Post-Exploitation Phase · unlock with TL Creds
• 🔒 GIBCRYPTO Keylogging and Screen Capture Exfiltration — C2 Phase · unlock with TL Creds
• 🔒 GIBCRYPTO Task Manager and Keyboard Disable via Registry — Exploitation Phase · unlock with TL Creds
• 🔒 GIBCRYPTO System DLL Destruction and Recovery Inhibition — Post-Exploitation Phase · unlock with TL Creds
• 🔒 GIBCRYPTO Full Kill Chain Correlation — C2 Phase · unlock with TL Creds
• 🔒 GIBCRYPTO AMSI Bypass and Defender Disablement — Exploitation Phase · unlock with TL Creds
• 🔒 GIBCRYPTO File Encryption and Shadow Copy Deletion — Post-Exploitation Phase · unlock with TL Creds

Indicators of compromise for GIBCRYPTO destructive ransomware

As of 2026-03-11, Threadlinqs Intelligence tracks 18 indicators of compromise for TL-2026-0210.

Sample indicators (2 of 18)

• Domain: api[.]telegram[.]org
• File hash: 1B56666BC5DB3351FC112245251620B2

Defanged, TLP:CLEAR. Full set of 18 indicators: unlock with TL Creds.

How GIBCRYPTO destructive ransomware works

GIBCRYPTO is a destructive ransomware variant implemented as a .NET PE executable, first observed on February 22, 2026 targeting systems in Germany. The malware represents a dangerous convergence of ransomware and wiper capabilities, with a shared command-and-control infrastructure linking it to the well-known Snake Keylogger malware family.

Upon execution, GIBCRYPTO follows a multi-stage attack chain. The malware first displays a ransom note and locks the user interface to prevent interaction. It then activates keylogging functionality to capture credentials and other sensitive input. Before encrypting files, GIBCRYPTO performs several defense evasion actions: it bypasses the Windows Antimalware Scan Interface (AMSI) through inline patching of the AmsiScanBuffer function, overwriting its first 6 bytes with the opcodes B8 57 00 07 80 C3, which forces the function to return error code 0x80070057 and immediately exit, effectively disabling PowerShell and script scanning. It also disables Windows Defender real-time monitoring via PowerShell cmdlets, blocks Task Manager through registry modification, and disables critical keyboard shortcuts including Alt, F4, Windows key, and Tab to prevent the user from accessing system controls.

The encryption routine uses the Salsa20 stream cipher with random 8-byte values generated per file as encryption keys. GIBCRYPTO loads entire files into RAM, encrypts them in-place, writes the encrypted version with a .gibcrypto extension, and deletes the original file. This approach means larger files consume significant memory during encryption.

What makes GIBCRYPTO particularly dangerous is its destructive post-encryption behavior. After encrypting user files, the malware corrupts the Master Boot Record (MBR), rendering the system unbootable. It also randomly overwrites system DLL files with random bytes at 5-second intervals, progressively degrading system stability. Additionally, it deletes shadow copies via cmd.exe to eliminate any possibility of system restore. These destructive capabilities effectively make GIBCRYPTO a wiper-ransomware hybrid — even if a victim pays the ransom, system recovery is extremely unlikely due to MBR corruption and DLL destruction.

The malware establishes persistence through Windows Registry Run keys to survive system reboots. For command and control, GIBCRYPTO uses the Telegram Bot API, exfiltrating victim data including usernames, machine names, and system screenshots to a Telegram channel controlled by the attacker. The critical infrastructure link is that GIBCRYPTO uses the identical Telegram bot token (8514918049:AAEyTqSuSZaPOdNZN08tL395l0SgCFg-ju8) and chat ID (7592909148) previously associated with Snake Keylogger campaigns, strongly suggesting a common threat actor or shared tooling between the two malware families.

Snake Keylogger (also known as 404 Keylogger) is a well-documented .NET-based credential stealer that has been responsible for over 280 million blocked infection attempts globally, typically spreading through phishing emails and using AutoIt-compiled binaries with process hollowing into RegSvcs.exe for evasion. The shared Telegram infrastructure indicates either a single operator deploying both tools or a shared malware-as-a-service backend.

The zeroed PE timestamp in the GIBCRYPTO binary is a deliberate anti-forensics technique to hinder timeline reconstruction. The combination of encryption, destruction, and espionage capabilities in a single payload, coupled with shared C2 infrastructure with a known infostealer, represents a significant escalation in ransomware sophistication.

---

**Revalidated on 2026-03-12**

No substantive changes warranted to the description at this time. The existing description accurately covers: (1) the .NET PE implementation, (2) Salsa20 encryption with random 8-byte nonces, (3) the AMSI bypass mechanism with correct opcodes, (4) MBR corruption and system DLL destruction wiper behavior, (5) the shared Telegram bot C2 with Snake Keylogger, and (6) defense evasion techniques. The only potential future addition would be if independent vendor analysis surfaces new technical details about the encryption key derivation, additional C2 channels, or lateral movement capabilities not covered in the K7 Labs report.

MITRE ATT&CK techniques by tactic:

discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

collection

T1056.001 Keylogging; T1113 Screen Capture

execution

T1059.001 PowerShell

defense-evasion

T1070.006 Timestomp

command-and-control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

impact

T1485 Data Destruction; T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561.002 Disk Structure Wipe

persistence

T1547.001 Registry Run Keys / Startup Folder

defense-impairment

T1553.006 Code Signing Policy Modification; T1685 Disable or Modify Tools; T1685.001 Disable or Modify Windows Event Log

Remediation for GIBCRYPTO destructive ransomware

Immediate actions

• Block Telegram Bot API endpoints (api.telegram.org) at network perimeter
• Monitor for processes modifying MBR or writing to physical disk sector 0
• Alert on AmsiScanBuffer patching attempts (opcode sequence B8 57 00 07 80 C3)
• Block execution of unknown .NET binaries with zeroed PE timestamps
• Isolate systems showing .gibcrypto file extensions immediately

Workarounds

• Disable PowerShell execution for non-administrative users
• Enable Windows Defender tamper protection via Group Policy
• Monitor Registry Run keys for unauthorized persistence entries
• Block outbound HTTPS to api.telegram.org at firewall level

Longer-term hardening

• Deploy EDR with behavioral detection for MBR modification and DLL overwrite patterns
• Implement application whitelisting to prevent unauthorized .NET executable execution
• Enable AMSI tamper protection and monitor for AMSI bypass attempts
• Maintain offline backups with regular integrity verification
• Deploy network segmentation to limit lateral movement after initial compromise

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022

Timeline of GIBCRYPTO destructive ransomware

• 2025-02-18 FortiGuard Labs documents evolving locked-ioc-14 variant with Telegram bot exfiltration and AutoIt obfuscation
• 2025-02-19 locked-ioc-14 variant responsible for over 280 million blocked infection attempts globally reported
• 2026-02-22 Initial locked-ioc-17 sample collected with MD5 hash locked-ioc-7
• 2026-02-22 locked-ioc-17 ransomware first observed targeting systems in Germany
• 2026-03-01 Shared Telegram bot token and chat ID identified linking locked-ioc-17 to locked-ioc-14 campaigns
• 2026-03-11 K7 Labs detection name Generic Ransomware(Type1) assigned to locked-ioc-17 samples
• 2026-03-11 K7 Labs publishes detailed technical analysis of locked-ioc-17 ransomware with locked-ioc-14 connection
• 2026-03-12 Malware.news aggregator syndicates K7 Labs locked-ioc-17 analysis, broadening visibility to wider security community
• 2026-05-29 As of 2026-05-29, locked-ioc-17 (CRITICAL destructive .NET wiper-ransomware, no CVE so no patch applies) remains ACTIVE with no observed takedown, arrest, or superseding successor. Its linked locked-ioc-14/Telegram C2 ecosystem is confirmed actively running fresh 2026 phishing campaigns, though locked-ioc-17 itself has had limited new coverage since the March K7 Labs disclosure.

Sources cited for GIBCRYPTO destructive ransomware

• RH-ISAC: New Snake Keylogger Variant Leverages New Scripting Tools rhisac.org · Advisory · 2025-02-20
• K7 Labs: GIBCRYPTO - The Destructive Ransomware with a Snake Keylogger Connection labs.k7computing.com · Research · 2026-03-11
• FortiGuard Labs: FortiSandbox Detects Evolving Snake Keylogger Variant Fortinet · Research · 2025-02-18
• Splunk: Under the Hood of SnakeKeylogger splunk.com · Research · 2024-09-12
• CyberArk: AMSI Bypass Patching Technique cyberark.com · Research · 2023-05-10
• Fortinet: Deep Analysis of Snake Keylogger New Variant Fortinet · Research · 2024-07-15
• Check Point: Snake Keylogger Malware Overview Check Point · Vendor report · 2025-01-01
• Cybereason: Threat Analysis Report - Snake Infostealer Malware cybereason.com · Research · 2024-03-20
• Hackread: Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots hackread.com · News · 2025-02-19

Threats related to GIBCRYPTO destructive ransomware

• Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa
• VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi

Previous and next in ransomware

• INC Ransom Affiliate Network Targeting Pacific Critical Infrastructure (AU/NZ/Tonga Joint Advisory) Previous report
• Warlock (Water Manaul / Storm-2603) Ransomware Campaign with BYOVD, Web Shells, and Multi-Channel Tunneling via SharePoint Exploitation Next report

Further reading

• Ransomware C2 Hosting Abuse: LockBit, BianLian