Threat reportRansomwareTL-2026-3817
EvilNominatus Ransomware - BAT-based ransomware with low AV detection (ClearSky)
EvilNominatus Ransomware (TL-2026-3817), also tracked as EvilNominatusCrypto, is a medium-severity ransomware operation, first published 2026-10-17. It has no confirmed attribution, affects Microsoft Windows, maps to 5 MITRE ATT&CK techniques (T1059.003, T1070.006, T1204.002), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3817
- Threat ID
- TL-2026-3817
- Also known as
- EvilNominatusCrypto, RozbehCrypt, EvilCrypt, RozbehRevenge, NominatusStrike
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in EvilNominatus Ransomware
Malware and tooling: DeathRansom, EvilNominatus, PoisonIvy, Trojan:Win32/Wacatac.B!ml, Win32:TrojanX-gen
How EvilNominatus Ransomware works
ClearSky detected a malicious BAT file uploaded to VirusTotal from Iran that executes ransomware associated with EvilNominatus, first exposed at the end of 2021. It appends '-Locked' to encrypted filenames and shows a ransom message directing victims to an email address; the original BAT was detected by only two AV engines and a later related BAT by none.
ClearSky Cyber Security reported a malicious BAT (batch) file uploaded to VirusTotal from Iran that executes ransomware associated with the EvilNominatus family, which was first exposed at the end of 2021 (other trackers record first observation on 2021-12-01). The developer is described by ClearSky as a young Iranian who boasted about the malware on Twitter. At the time of ClearSky's research there were no details about victims; the report was published because of the unusual BAT-driven method of operation and the very low AV detection: the original BAT was flagged by only two engines on VirusTotal, and a later BAT sharing its characteristics was flagged by none.
Per public removal guides and the ransom message, the ransomware encrypts files and appends the string '-Locked' to the filename (e.g. 1.jpg becomes 1.jpg-Locked); some files are encrypted more than once, producing multiple '-Locked' suffixes. The message claims the backups were deleted and that taskmgr, regedit and more were disabled, warns that entering the wrong key 3 times will 'make you see the dark side', and tells the victim to contact bkhtyaryrwzbh@gmail.com. Elastio records ransom notes named notes/message.txt and notes/NominatusRansomware2Message.txt (Desktop), timestamp updates on encrypted files, and associated executables including EvilNominatus.exe, antivirusscan.exe, FreeNet.exe and RozbehRevenge.exe. Aliases tracked: EvilNominatusCrypto, RozbehCrypt, EvilCrypt, RozbehRevenge, NominatusStrike. No free decryptor is known.
VERIFICATION LIMITATION: the ClearSky article itself could not be fetched (empty content); its facts come from search-result summaries and secondary sources (PCrisk, Elastio). No CVEs, network IOCs (IPs/domains) or C2 infrastructure were identified, so no BeaconBeagle correlation was possible. Distribution methods listed by PCrisk (macro attachments, torrents, malvertising) are generic to its template and are not confirmed by ClearSky for this campaign. Severity is analyst judgment.
MITRE ATT&CK techniques used in TL-2026-3817
Execution
T1059.003 Windows Command Shell; T1204.002 Malicious File
Defense Evasion
Impact
defense-impairment
Affected products and versions in EvilNominatus Ransomware
- Microsoft — Windows
Vulnerable versions: Not specified in sources
Remediation for EvilNominatus Ransomware
Immediate actions
- Isolate affected hosts and preserve the BAT file and ransom notes for analysis
- Block execution of unsigned .bat/.cmd files delivered via email, downloads or removable media
- Hunt for files ending in '-Locked' and for notes/message.txt or NominatusRansomware2Message.txt
Workarounds
- Restrict script interpreters (cmd.exe, wscript) for standard users via application control
- No third-party decryptor is known; restore from clean backups
Longer-term hardening
- Maintain offline/immutable backups, since the malware reportedly deletes default backups
- Deploy EDR with behavioral detection for mass file renaming, backup deletion and Task Manager/Regedit disabling
- Do not rely on signature AV alone: the sample was detected by 0-2 engines
Timeline of EvilNominatus Ransomware
- EvilNominatus ransomware first observed in the wild (per Elastio/PCrisk)
- EvilNominatus family exposed publicly at the end of 2021, per ClearSky (day-level precision not stated)
- Public removal guides for EvilNominatus appear (waystoprotectcomputer.com, February 2022; day-level precision not stated)
- ClearSky publishes its EvilNominatus report on a BAT file uploaded to VirusTotal from Iran, detected by only 2 AV engines (date inferred from the report PDF filename 7.4.22 and April 2022 archive)
- ClearSky notes a later related BAT file with shared characteristics detected by 0 AV engines (undated in sources; placed after the report for ordering)
- ClearSky report PDF mirrored at 1275.ru (upload path 2023/04)
Sources cited for EvilNominatus Ransomware
- EvilNominatus Ransomware - ClearSky
- ClearSky April 2022 archive (EvilNominatus Ransomware)
- ClearSky EvilNominatus Ransomware (shortlink)
- ClearSky EvilNominatus report PDF mirror (7.4.22)
- PCrisk - EvilNominatus (-Locked) ransomware removal and decryption options
- Elastio - EvilNominatus ransomware profile
- EnigmaSoft - EvilNominatus Ransomware removal
- Delete EvilNominatus ransomware Quickly
Detection coverage for TL-2026-3817
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3817 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.