# GIBCRYPTO Destructive Ransomware with Snake Keylogger Shared Telegram C2 Infrastructure

> GIBCRYPTO is a destructive .NET ransomware first observed February 22, 2026 in Germany that uses Salsa20 stream cipher encryption and appends the .gibcrypto extension to encrypted files. It shares identical Telegram bot C2 infrastructure with Snake Keylogger, performs MBR corruption, system DLL destruction, AMSI bypass via inline patching of AmsiScanBuffer, and Windows Defender disablement, making recovery nearly impossible even if ransom is paid.

- **Published:** 2026-03-11T12:00:00Z
- **Last reviewed:** 2026-03-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0210
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-gibcrypto-destructive-ransomware-tl-2026-0210.webp?v=10ae0762 (Threadlinqs threat intel: GIBCRYPTO Destructive Ransomware: Detection & IOCs (TL-2026-0210) — Critical severity, 18 IOCs, 9 detection rules.)
- **ID:** TL-2026-0210
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 18 (2 shown free below)

## Description

GIBCRYPTO is a destructive ransomware variant implemented as a .NET PE executable, first observed on February 22, 2026 targeting systems in Germany. The malware represents a dangerous convergence of ransomware and wiper capabilities, with a shared command-and-control infrastructure linking it to the well-known Snake Keylogger malware family.

Upon execution, GIBCRYPTO follows a multi-stage attack chain. The malware first displays a ransom note and locks the user interface to prevent interaction. It then activates keylogging functionality to capture credentials and other sensitive input. Before encrypting files, GIBCRYPTO performs several defense evasion actions: it bypasses the Windows Antimalware Scan Interface (AMSI) through inline patching of the AmsiScanBuffer function, overwriting its first 6 bytes with the opcodes B8 57 00 07 80 C3, which forces the function to return error code 0x80070057 and immediately exit, effectively disabling PowerShell and script scanning. It also disables Windows Defender real-time monitoring via PowerShell cmdlets, blocks Task Manager through registry modification, and disables critical keyboard shortcuts including Alt, F4, Windows key, and Tab to prevent the user from accessing system controls.

The encryption routine uses the Salsa20 stream cipher with random 8-byte values generated per file as encryption keys. GIBCRYPTO loads entire files into RAM, encrypts them in-place, writes the encrypted version with a .gibcrypto extension, and deletes the original file. This approach means larger files consume significant memory during encryption.

What makes GIBCRYPTO particularly dangerous is its destructive post-encryption behavior. After encrypting user files, the malware corrupts the Master Boot Record (MBR), rendering the system unbootable. It also randomly overwrites system DLL files with random bytes at 5-second intervals, progressively degrading system stability. Additionally, it deletes shadow copies via cmd.exe to eliminate any possibility of system restore. These destructive capabilities effectively make GIBCRYPTO a wiper-ransomware hybrid — even if a victim pays the ransom, system recovery is extremely unlikely due to MBR corruption and DLL destruction.

The malware establishes persistence through Windows Registry Run keys to survive system reboots. For command and control, GIBCRYPTO uses the Telegram Bot API, exfiltrating victim data including usernames, machine names, and system screenshots to a Telegram channel controlled by the attacker. The critical infrastructure link is that GIBCRYPTO uses the identical Telegram bot token (8514918049:AAEyTqSuSZaPOdNZN08tL395l0SgCFg-ju8) and chat ID (7592909148) previously associated with Snake Keylogger campaigns, strongly suggesting a common threat actor or shared tooling between the two malware families.

Snake Keylogger (also known as 404 Keylogger) is a well-documented .NET-based credential stealer that has been responsible for over 280 million blocked infection attempts globally, typically spreading through phishing emails and using AutoIt-compiled binaries with process hollowing into RegSvcs.exe for evasion. The shared Telegram infrastructure indicates either a single operator deploying both tools or a shared malware-as-a-service backend.

The zeroed PE timestamp in the GIBCRYPTO binary is a deliberate anti-forensics technique to hinder timeline reconstruction. The combination of encryption, destruction, and espionage capabilities in a single payload, coupled with shared C2 infrastructure with a known infostealer, represents a significant escalation in ransomware sophistication.

---

**Revalidated on 2026-03-12**

No substantive changes warranted to the description at this time. The existing description accurately covers: (1) the .NET PE implementation, (2) Salsa20 encryption with random 8-byte nonces, (3) the AMSI bypass mechanism with correct opcodes, (4) MBR corruption and system DLL destruction wiper behavior, (5) the shared Telegram bot C2 with Snake Keylogger, and (6) defense evasion techniques. The only potential future addition would be if independent vendor analysis surfaces new technical details about the encryption key derivation, additional C2 channels, or lateral movement capabilities not covered in the K7 Labs report.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1070.006 Timestomp
- T1553.006 Code Signing Policy Modification
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1561.002 Disk Structure Wipe
- T1529 System Shutdown/Reboot
- T1685.001 Disable or Modify Windows Event Log

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GIBCRYPTO Telegram Bot API C2 Exfiltration — C2 Phase** (`TL-2026-0210-SPL-003`)

Detects GIBCRYPTO command-and-control communication via Telegram Bot API. The malware exfiltrates victim data (usernames, machine names, screenshots) to a Telegram channel. This same infrastructure is shared with Snake Keylogger campaigns, making Telegram Bot API traffic from non-browser processes a critical indicator.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1102.002, T1567
- **Data sources:** proxy, firewall, microsoft_defender_for_endpoint, dns
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="bluecoat" OR sourcetype="squid" OR sourcetype="pan:traffic" OR sourcetype="fortigate_traffic" (url="*api.telegram.org/bot*" OR url="*api.telegram.org/bot*/sendMessage*" OR url="*api.telegram.org/bot*/sendPhoto*" OR url="*api.telegram.org/bot*/sendDocument*" OR cs_host="api.telegram.org") NOT (src_process="chrome.exe" OR src_process="firefox.exe" OR src_process="msedge.exe" OR src_process="Telegram.exe") | eval detection_phase="c2", threat="GIBCRYPTO" | stats count min(_time) as first_seen max(_time) as last_seen values(url) as urls values(src_ip) as source_ips values(src_process) as processes by src_host | where count >= 1 | table src_host, first_seen, last_seen, count, urls, source_ips, processes
```

### Microsoft KQL

```kql
let timeframe = 24h;
let telegram_c2 = DeviceNetworkEvents
    | where Timestamp > ago(timeframe)
    | where RemoteUrl has "api.telegram.org/bot"
       or RemoteUrl has "api.telegram.org"
    | where InitiatingProcessFileName !in~ ("chrome.exe", "firefox.exe", "msedge.exe", "Telegram.exe", "Teams.exe", "slack.exe")
    | project Timestamp, DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
let dns_telegram = DeviceEvents
    | where Timestamp > ago(timeframe)
    | where ActionType == "DnsQueryResponse"
    | where AdditionalFields has "api.telegram.org"
    | project Timestamp, DeviceName, AccountName, AdditionalFields;
union telegram_c2, dns_telegram
| summarize EventCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), URLs=make_set(RemoteUrl), Processes=make_set(InitiatingProcessFileName) by DeviceName, AccountName
| project DeviceName, AccountName, FirstSeen, LastSeen, EventCount, URLs, Processes
```

### Sigma

```yaml
title: GIBCRYPTO Telegram Bot API C2 Communication from Non-Browser Process
id: a1b2c3d4-0210-4003-b003-aabbccdd0007
status: experimental
description: Detects outbound HTTPS connections to api.telegram.org from non-browser processes, indicative of GIBCRYPTO ransomware or Snake Keylogger C2 data exfiltration via Telegram Bot API.
references:
    - https://labs.k7computing.com/index.php/gibcrypto-the-destructive-ransomware-with-a-snake-keylogger-connection/
    - https://intel.threadlinqs.com/threats/TL-2026-0210
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-03-11
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102.002
    - attack.exfiltration
    - attack.t1567
logsource:
    category: proxy
detection:
    selection:
        c-uri|contains: 'api.telegram.org/bot'
    filter_browsers:
        c-process|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\Telegram.exe'
    condition: selection and not filter_browsers
falsepositives:
    - Legitimate IT automation scripts using Telegram bots for alerting
    - Custom internal applications leveraging Telegram Bot API for notifications
level: high
```

**Known false positives:**

- Legitimate IT automation scripts using Telegram bots for alerting
- Custom internal applications leveraging Telegram Bot API for notifications

**Tuning notes:** Allowlist known IT automation servers that use Telegram bots for monitoring alerts. Consider blocking api.telegram.org at the firewall for environments that do not use Telegram. Correlate with .gibcrypto file events or AMSI bypass for confirmed GIBCRYPTO attribution.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- GIBCRYPTO .NET Execution with Zeroed PE Timestamp — Exploitation Phase (locked: unlock with TL Creds)
- GIBCRYPTO Registry Persistence and MBR Corruption — Post-Exploitation Phase (locked: unlock with TL Creds)
- GIBCRYPTO Keylogging and Screen Capture Exfiltration — C2 Phase (locked: unlock with TL Creds)
- GIBCRYPTO Task Manager and Keyboard Disable via Registry — Exploitation Phase (locked: unlock with TL Creds)
- GIBCRYPTO System DLL Destruction and Recovery Inhibition — Post-Exploitation Phase (locked: unlock with TL Creds)
- GIBCRYPTO Full Kill Chain Correlation — C2 Phase (locked: unlock with TL Creds)
- GIBCRYPTO AMSI Bypass and Defender Disablement — Exploitation Phase (locked: unlock with TL Creds)
- GIBCRYPTO File Encryption and Shadow Copy Deletion — Post-Exploitation Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 18)

Defanged, TLP:CLEAR.

- Domain: `api[.]telegram[.]org`
- File hash: `1B56666BC5DB3351FC112245251620B2`

Full set of 18 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [K7 Labs: GIBCRYPTO - The Destructive Ransomware with a Snake Keylogger Connection](https://labs.k7computing.com/index.php/gibcrypto-the-destructive-ransomware-with-a-snake-keylogger-connection/)
- [FortiGuard Labs: FortiSandbox Detects Evolving Snake Keylogger Variant](https://www.fortinet.com/blog/threat-research/fortisandbox-detects-evolving-snake-keylogger-variant)
- [Hackread: Snake Keylogger Variant Hits Windows, Steals Data via Telegram Bots](https://hackread.com/snake-keylogger-variant-windows-data-telegram-bots/)
- [Splunk: Under the Hood of SnakeKeylogger](https://www.splunk.com/en_us/blog/security/under-the-hood-of-snakekeylogger-analyzing-its-loader-and-its-tactics-techniques-and-procedures.html)
- [CyberArk: AMSI Bypass Patching Technique](https://www.cyberark.com/resources/threat-research-blog/amsi-bypass-patching-technique)
- [Fortinet: Deep Analysis of Snake Keylogger New Variant](https://www.fortinet.com/blog/threat-research/deep-analysis-of-snake-keylogger-new-variant)
- [Check Point: Snake Keylogger Malware Overview](https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/snake-keylogger-malware/)
- [Cybereason: Threat Analysis Report - Snake Infostealer Malware](https://www.cybereason.com/blog/research/threat-analysis-report-snake-infostealer-malware)
- [RH-ISAC: New Snake Keylogger Variant Leverages New Scripting Tools](https://rhisac.org/threat-intelligence/new-snake-keylogger/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0210