[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Netwalker Ransomware? Attack Methods & Protection Tips](/blog/what-is-netwalker-ransomware) Publish date November 28, 2025 {x} minute read # What is Netwalker Ransomware? Attack Methods & Protection Tips [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-ultimate-ransomware-defense-guide) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) Since [ransomware](https://www.upguard.com/blog/ransomware) was founded in 1996, many ransomware gangs have attempted and failed to quake the [cybersecurity](https://www.upguard.com/blog/cyber-security) landscape. But some have broken through and even rearranged it with their obfuscatory [cyberattack](https://www.upguard.com/blog/cyber-attack) methods. Netwalker ransomware is an example of such a success. Within its first six months of operation, the ransomware gang received [more than $25 million](https://www.crn.com.au/news/equinix-breach-7-things-to-know-about-netwalker-ransomware-attacks-553216) in ransom payments. What is Netwalker ransomware and why is it so lethal? To learn more, read on. ## What is Netwalker Ransomware? Netwalker ransomware is a Window's specific ransomware that encrypts and exfiltrates all of the data it beaches. After a successful attack, victims are presented with a ransom note demanding a bitcoin payment in exchange for a full decryption of the compromised data. The secret behind Netwalker's ransom payout success lies in their double-extortion tactic, a strategy also used by [the notorious ransomware gang Maze](https://www.upguard.com/blog/what-is-egregor-ransomware). A sample of the breached [sensitive data](https://www.upguard.com/blog/sensitive-data) is instantly published on the [dark web](https://www.upguard.com/blog/dark-web) as proof of the breach. Victims are presented with this evidence and given an ultimatum to pay the ransom price to avoid further publishing on the criminal infested network. The cybercriminals group behind the Netwalker ransomware is known as Circus Spider. ## How Did Netwalker Ransomware Become Popular? In March 2020, Netwalker ransomware shifted to a Ransomware-as-a-Service model (RaaS). This is an adaptation of the Software-as-a-Service model. Criminal affiliates sign up to launch cyberattacks with the ransomware. SaaS products empower users to execute complex processes, in just about any industry, without coding expertise. LIkewise, RaaS solutions empower even the most novel hackers to execute [highly sophisticated ransomware attacks](https://www.upguard.com/blog/ransomware-attacks-vs-data-breaches). Since shifting to an [RaaS model](https://www.upguard.com/blog/what-is-ransomware-as-a-service), Netwalker expanded its global reach in a very short period of time. Criminal affiliates receive an extravagant percentage of each ransom payment, and with an unlimited earning potential, they're motivated to rapidly spread the ransomware far and wide. But multiplying RaaS affiliates is not the only key to achieving a heinous global reputation. Even though RaaS solutions don't require expert hackers, it does help to be one. Cybersecurity defenses now consist of complex firewall layers and secure VPNs. To infiltrate these barriers, you cannot solely rely on the RaaS solution. You need additional hacking expertise to tailor breaching solutions for each unique breaching problem. With such an expert network, each affiliate's chances of penetration will be high, and with the resulting successful breach streak, the utilized RaaS tool will build upon its rapidly developing reputation. To recruit these expert affiliates, Circus Spider posted invitations to their affiliate program, alongside a list of essential criteria, in** **Russian criminal forums on the dark web. Netwalker ransomware affiliates need to: * Be fluent Russian-speaking and Russian-typing hackers * Have extensive ransomware attack experience * Have extensive network penetration experience * Have an extensive list of high profile targets * Be capable of providing evidence of all their experience. in a leaked recruitment post, it was discovered that Circus Spider broaden their focus to internet-exposed Remote Desktop Protocols (RDPs) rather than just the ubiquitous [spear-phishing](https://www.upguard.com/blog/spear-phishing) [attack vector](https://www.upguard.com/blog/attack-vector). > ...and now, the Netwalker (Mailto) ransomware gang is also looking for two partners specialized in network attacks\ > \ > Trend for ransomware attacks/intrusions is pretty obvious these days. Gangs moving away from spear-phishing to targeting internet-exposed RDPs and servers. [pic.twitter.com/VKWl9Q0vaa](https://t.co/VKWl9Q0vaa) > > — Catalin Cimpanu (@campuscodi) [April 29, 2020](https://twitter.com/campuscodi/status/1255427693723693056?ref_src=twsrc%5Etfw) To make their offer tantalising, Circus Spider [published a list of benefits](https://www.hhs.gov/sites/default/files/netwalker.pdf) for successful candidates including: * Unlimited access to autocrypt.exe after the first payout of at least 10 BTK * Access to a PowerShell (a method of distributing ransomware via an email attachment) after the first payout of at least 10 BTK * Opportunity to personally work for the ransomware gang on a contractual basis Netwalker ransomware affiliates are well looked after. Compared to other RaaS solutions, Netwalker is on the generous end of the spectrum, paying their affiliates up to 80% of each successful ransom payment. With their army of seasoned threat actors at the ready, Netwalker (also known as mailto) launched their first wave of RaaS attacks in March 2020. The cybercrime network worked relentlessly, tipping over business after business, taking advantage of global coronavirus distractions. ## Who Does Netwalker Target? Netwalker attackers even targeted the healthcare sector, tricking staff into injecting the [malware](https://www.upguard.com/blog/malware) through Covid-themed [phishing emails](https://www.upguard.com/blog/phishing). These attacks were severe enough to prompt[ a flash alert by the FBI](https://www.aha.org/system/files/media/file/2020/08/FLASH-MI-000130-MW.pdf) in July 2020. Some of Netwalker's notable victims included: * The [Crozer-Keystone Health System](https://www.cyberscoop.com/crozer-keystone-cyber-attack-netwalker-ransomware/) * Australian transport company [Toll Group](https://siliconangle.com/2020/02/03/transport-company-toll-group-crippled-suspected-ransomware-attack/) * [California University's Covid research sector](https://www.bloomberg.com/news/articles/2020-06-04/hackers-target-california-university-leading-covid-19-research) * The [Austrian city of Weiz](https://cointelegraph.com/news/ransomware-attack-kidnaps-austrian-city) * [K-Electric](https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-pakistans-largest-private-power-utility/), Pakistan's largest private power utility. * [Argentina's official immigration agency](https://www.bleepingcomputer.com/news/security/netwalker-ransomware-hits-argentinian-government-demands-4-million/) Besides the health sector, [the following industries](https://www.hhs.gov/sites/default/files/netwalker.pdf) are also targeted by Netwalker: * Business management solutions * Customer experience management * Manufacturing * Education and battery management Netwalker spread their net over a digital world that overlooked its security posture amid the pandemic chaos, claiming victims over a majority of the globe in a few short months. ## How Does Netwalker Ransomware Work? Netwalker ransomware is most commonly introduced into an ecosystem via phishing emails. These emails [appear to come from legitimate sources,](https://www.upguard.com/blog/spf) so recipients are tricked into click on links and downloading attachments. In their machiavellian Covid-themes phishing emails, Netwalker attached a visual basic script titled CORONAVIRUS\_COVID-19.vbs Here's an example of a Netwalker phishing email. When these phishing email scripts are activated, the executable saved in the victim's temp folder and the attack is initiated. Victims are unaware of anything unusual happening as the Netwalker ransomware infects their systems. This is because the malware operates clandestinity under the guide of legitimate Microsoft processes. This is achieved through a technique known as 'process harrowing', where code from Microsoft's executable is replaced with Netwalker's malicious code to access\ \ Netwalker then initiates a mass exfiltration of all the breached sensitive data, The stolen data is also heavily encrypted to prevent victims from getting access to the compromised data. Only when the attack is complete does the victim notice that their system has been compromised. A ransom note left by attackers in a TXT file confirms any suspicions. After the ransom note has been deployed, a subset of the exfiltrated data is published on the dark web and shown to the victim as proof of the successful breach. This is when the clock starts ticking and victims are pressured to make the ransom payment to avoid further sensitive data being published on the dark web. Victims are instructed to submit their ransom payment via an anonymous communication network, through a TOR browser portal Victims are provided with a decryption tool for their specific Netwalker variant when a ransom payment is made. [*Learn more about how to decrypt ransomware.*](https://www.upguard.com/blog/how-to-decrypt-ransomware) ## How to Protect Yourself from Netwalker Ransomware The following mitigation procedures are recommended to defend your business from Netwalker attacks. ### Backup all of your data on external hard drives External hard drives should not replace cloud storage, but rather complement it. Offline backups are very difficult to penetrate and they'll become your primary source of truth if your cloud data is compromised. Implement a highly efficient and regulatory external hard drive [back up process.](https://www.upguard.com/blog/how-to-back-up-your-data) ### Enforce two-factor authentication Ensure you and all of your staff [enable two-factor authentication](https://www.upguard.com/blog/two-factor-authentication) for all of your processes. Though it may cause vexation at times, this security barrier is still one of the most effective defenses against cyber attacks. ### Ensure all software patches are up to date Outdated software is not protected by the latest security patches. Vendors are always developing security updates to ensure their customers are not breached through [vulnerabilities](https://www.upguard.com/blog/vulnerability) in their software. This includes regularly updating your antivirus and anti-malware software. ### Regularly update endpoint passwords Ensure your endpoint passwords are highly secure and updated regularly. You should also enable two-factor authentication for all your endpoints. ### Monitor your security posture Netwalker ransomware, like all ransomware, penetrates through vulnerabilities in a business's security defences. By [continuously monitoring and strengthening your security posture](https://www.upguard.com/product/breach-risk), you will dramatically decrease your chances of falling victim to a Netwalker attack. ### Implement a third-party risk management solution Cyberattacks often slip through the defenses of your vendors, placing your business as the next victim in line for an attack. As evidenced by Netwalker's RAPID growth, cyber attacks move at lightning speed, so you cannot solely rely on your vendors to notify you of a breach before it's too late. By implementing a [Third-Party Risk Management software](https://www.upguard.com/product/vendor-risk/third-party-risk-assessments) solution, you'll be equipped to prevent third part breaches and discover potential vendor risks. ### Is your business at risk of a Netwalker attack? At UpGuard, we can help you strengthen your security posture to effectively defend against ransomware attacks. Our patented cybersecurity technology also continuously monitors for vulnerabilities in your entire vendor network to prevent cyber attacks from compromised third parties. eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)