Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks

The ransomware is rudimentary with basic functionalities, likely having been created by an inexperienced developer — but its effective at locking up files and sucking up memory capacity.

A ransomware strain coined ShadowRoot has been found targeting Turkish businesses through
phishing attacks
.
The phishing emails contain a PDF attachment disguised as an invoice with embedded malicious links. Upon user interaction, this triggers a download of a RootDesign.exe file hosted on a compromised GitHub account.
The downloaded file is a Delphi binary and, according to researchers at Forcepoint who analyzed the exe, it drops further payloads: C:TheDreamRootDesign.exe, C:TheDreamUninstall.exe” and “C:TheDreamUninstall.ini.
We have observed recursive self-process creation by RootDesign.exe, which causes the files to get encrypted multiple times, resulting in higher memory consumption,
the researchers said
. It also drops many copies of encrypted files on the root.
They add that the ransomware appears rudimentary and likely the work belonging to an inexperienced developer.
In addition to user awareness for defense, the researchers recommend blocking the following email addresses to prevent being targeted by the Shadowroot threat actors:
Kurumsal[.]tasilat[@]internet[.]ru
ran_master_som[@]proton[.]me
lasmuruk[@]mailfence[.]com

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Shadowroot Ransomware Lures Turkish Victims via Phishing Attacks