{ "id": "a9e2df9e-a61b-46c2-91ac-305d08555378", "created_at": "2026-04-06T00:10:34.712107Z", "updated_at": "2026-04-10T03:20:48.21674Z", "deleted_at": null, "sha1_hash": "fe65a17eb4721e90ccef81c632ee3cfdf2d694be", "title": "Ransomware gang's script shows exactly the files they're after", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1463413, "plain_text": "Ransomware gang's script shows exactly the files they're after\r\nBy Lawrence Abrams\r\nPublished: 2021-08-24 · Archived: 2026-04-05 21:31:34 UTC\r\nA PowerShell script used by the Pysa ransomware operation gives us a sneak peek at the types of data they attempt to steal\r\nduring a cyberattack.\r\nWhen ransomware gangs compromise a network, they usually start with limited access to a single device.\r\nThey then use various tools and exploits to steal other credentials used on the Windows domain or gain elevated privileges\r\non different devices.\r\nhttps://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nOnce they gain access to a Windows domain controller, they search for and steal data on the network before encrypting\r\ndevices.\r\nThe threat actors use this stolen data in two ways.\r\nThe first is to generate a ransom demand based on company revenue and whether they have insurance policies. The second\r\nis to scare the victims into paying a ransom because the gang will leak the data.\r\nSearching for valuable data\r\nYesterday, MalwareHunterTeam shared a PowerShell script with BleepingComputer used by the Pysa ransomware operation\r\nto search for and exfiltrate data from a server.\r\nThis script is designed to scan each drive for data folders whose names match certain strings on a device. If a folder matches\r\nthe search criteria, the script will upload the folder's files to a remote drop server under the threat actor's control.\r\nOf particular interest are the 123 keywords that the script searches for, which give us a glimpse into what the ransomware\r\ngang considers valuable.\r\nAs we would expect, the script seeks out files related to the companies financials or personal information, such as audit,\r\nbanking information, login credentials, tax forms, student information, social security numbers, and SEC filings.\r\nHowever, it also looks for more intriguing keywords that could be particularly harmful to a company if leaked, such\r\nas folders containing the words 'crime', 'investigation', 'fraud', 'bureau', 'federal', 'hidden', 'secret', 'illegal', and 'terror.'\r\nThe full list of 123 keywords targeted by the threat actors' script is listed in the table below.\r\n941 confident Info RRHH\r\n1040 Crime insider saving\r\n1099 claim Insurance scans\r\n8822 Terror investigation sec\r\n9465 Confidential*Disclosure IRS secret\r\n401K contact ITIN security\r\n4506-T contr K-1 studen\r\nABRH CPF letter seed\r\nAudit CRH List Signed\r\nAddres Transact Login sin\r\nagreem DDRH mail soc\r\nAgreement*Disclosure Demog NDA SS#\r\nARH Detail Numb SS-4\r\nAssignment Disclosure*Agreement Partn SSA\r\nbalanc Disclosure*Confidential passport SSN\r\nbank DRH passwd Staf\r\nBank*Statement emplo password statement\r\nhttps://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/\r\nPage 3 of 5\n\nBenef Enrol pay Statement*Bank\r\nbilling federal payment SWIFT\r\nbudget Finan payroll tax\r\nbureau finance person Taxpayer\r\nBrok Form Phone unclassified\r\ncard fraud privacy Vend\r\ncash government privat W-2\r\nCDA hidden pwd w-4\r\nchecking hir Recursos*Humanos W-7\r\nclandestine HR report W-8BEN\r\ncompilation Human Resour w-9\r\ncompromate i-9 resurses*human W-9S\r\nconcealed illegal RHO  \r\nconfid important routing  \r\nIt does not make sense to change your folder names, so they do not include these strings, as the threat actors will likely\r\nperform manual sweeps of data.\r\nHowever, knowing what types of data a ransom gang is searching for gives you a better indication of how ransomware\r\ngangs will attempt to extort their victims.\r\nPysa is not the only one searching for particular files after breaching a network.\r\nEarlier this month, an angry Conti affiliate leaked the training material for the ransomware operation.\r\nThis training material told affiliates to immediately search for data containing the following keywords after they gained\r\ncontrol of a Windows domain controller.\r\ncyber\r\npolicy\r\ninsurance\r\nendorsement\r\nsupplementary\r\nunderwriting\r\nterms\r\nbank\r\n2020\r\n2021\r\nStatement\r\nOnce again, this illustrates how vital data theft is to a ransomware attack and how important it is to safeguard it adequately.\r\nhttps://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/\r\nhttps://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.bleepingcomputer.com/news/security/ransomware-gangs-script-shows-exactly-the-files-theyre-after/" ], "report_names": [ "ransomware-gangs-script-shows-exactly-the-files-theyre-after" ], "threat_actors": [], "ts_created_at": 1775434234, "ts_updated_at": 1775791248, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/fe65a17eb4721e90ccef81c632ee3cfdf2d694be.pdf", "text": "https://archive.orkl.eu/fe65a17eb4721e90ccef81c632ee3cfdf2d694be.txt", "img": "https://archive.orkl.eu/fe65a17eb4721e90ccef81c632ee3cfdf2d694be.jpg" } }