# EvilNominatus Ransomware - BAT-based ransomware with low AV detection (ClearSky)

> ClearSky detected a malicious BAT file uploaded to VirusTotal from Iran that executes ransomware associated with EvilNominatus, first exposed at the end of 2021. It appends '-Locked' to encrypted filenames and shows a ransom message directing victims to an email address; the original BAT was detected by only two AV engines and a later related BAT by none.

- **Published:** 2026-10-17T15:19:10Z
- **Last reviewed:** 2026-10-17T15:19:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3817
- **ID:** TL-2026-3817
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClearSky Cyber Security reported a malicious BAT (batch) file uploaded to VirusTotal from Iran that executes ransomware associated with the EvilNominatus family, which was first exposed at the end of 2021 (other trackers record first observation on 2021-12-01). The developer is described by ClearSky as a young Iranian who boasted about the malware on Twitter. At the time of ClearSky's research there were no details about victims; the report was published because of the unusual BAT-driven method of operation and the very low AV detection: the original BAT was flagged by only two engines on VirusTotal, and a later BAT sharing its characteristics was flagged by none.

Per public removal guides and the ransom message, the ransomware encrypts files and appends the string '-Locked' to the filename (e.g. 1.jpg becomes 1.jpg-Locked); some files are encrypted more than once, producing multiple '-Locked' suffixes. The message claims the backups were deleted and that taskmgr, regedit and more were disabled, warns that entering the wrong key 3 times will 'make you see the dark side', and tells the victim to contact bkhtyaryrwzbh@gmail.com. Elastio records ransom notes named notes/message.txt and notes/NominatusRansomware2Message.txt (Desktop), timestamp updates on encrypted files, and associated executables including EvilNominatus.exe, antivirusscan.exe, FreeNet.exe and RozbehRevenge.exe. Aliases tracked: EvilNominatusCrypto, RozbehCrypt, EvilCrypt, RozbehRevenge, NominatusStrike. No free decryptor is known.

VERIFICATION LIMITATION: the ClearSky article itself could not be fetched (empty content); its facts come from search-result summaries and secondary sources (PCrisk, Elastio). No CVEs, network IOCs (IPs/domains) or C2 infrastructure were identified, so no BeaconBeagle correlation was possible. Distribution methods listed by PCrisk (macro attachments, torrents, malvertising) are generic to its template and are not confirmed by ClearSky for this campaign. Severity is analyst judgment.

## MITRE ATT&CK

- T1059.003 Windows Command Shell
- T1204.002 Malicious File
- T1685 Disable or Modify Tools
- T1070.006 Timestomp
- T1490 Inhibit System Recovery

## Sources

- [EvilNominatus Ransomware - ClearSky](https://www.clearskysec.com/evilnominatus-ransomware/)
- [ClearSky April 2022 archive (EvilNominatus Ransomware)](https://www.clearskysec.com/2022/04/)
- [ClearSky EvilNominatus Ransomware (shortlink)](https://www.clearskysec.com/?p=3605)
- [ClearSky EvilNominatus report PDF mirror (7.4.22)](https://1275.ru/wp-content/uploads/2023/04/evilnominatus_ransomware_7.4.22.pdf)
- [PCrisk - EvilNominatus (-Locked) ransomware removal and decryption options](https://www.pcrisk.com/removal-guides/23113-evilnominatus-ransomware)
- [Elastio - EvilNominatus ransomware profile](https://elastio.com/detectable-ransomware/evilnominatus)
- [EnigmaSoft - EvilNominatus Ransomware removal](https://www.enigmasoftware.com/evilnominatusransomware-removal/)
- [Delete EvilNominatus ransomware Quickly](https://waystoprotectcomputer.com/2022/02/delete-evilnominatus-ransomware-quickly/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3817