Shanya
Shanya is a packer-as-a-service (PaaS) / crypter used to obfuscate and load malicious payloads, and is increasingly associated with ransomware operations. Sophos reported that it emerged on underground forums in late 2024, where a related offering called VX Crypt was attributed to an entity named "Shanya." Advertised features included non-standard in-memory module loading, unique stubs per customer, AMSI bypass for .NET assemblies, anti-VM and anti-sandbox behavior, and optional sideloading. It has also been referred to by other researchers as TangleCrypt and possibly the Armillaria loader.
Technically, Shanya uses heavy junk-code obfuscation, dynamic API resolution via custom hashing, and anti-analysis checks involving RtlDeleteFunctionTable. It decrypts and decompresses payloads in memory and loads them by mapping a second copy of shell32.dll, overwriting the image header and .text section with the decrypted payload, and altering module metadata in the PEB to disguise the mapped image. Sophos also reported that Shanya stores a pointer to an internal configuration table in the PEB GdiHandleBuffer field. Observed sample naming included shanya_crypter.exe and DLL names derived from "Shanya."
A major observed use case is packaging an EDR killer used ahead of ransomware deployment. In these cases, Shanya-packed malware commonly uses DLL side-loading with legitimate binaries such as consent.exe and malicious DLLs including msimg32.dll, version.dll, rtworkq.dll, and wmsgapi.dll. The EDR killer drops a legitimate vulnerable TechPowerUp driver, ThrottleStop.sys or rwdrv.sys, together with a malicious unsigned kernel driver, hlpdrv.sys. The user-mode component enumerates targeted security-product services and processes and sends kill commands to the kernel driver to disable protections. Reporting cited first observed deployment near the end of April 2025 in a Medusa ransomware attack, with later use in Akira, Qilin, and Crytox operations.
Shanya has also been used outside pure ransomware deployment chains. Sophos linked it to delivery of BumbleBee, ChuChuka, Lumma, WHT downloader, StealC, and CastleRAT. In September 2025 it was associated with a Booking.com-themed ClickFix campaign targeting hotels, in which PowerShell downloaded content from biokdsl[.]com/upd or biklkfd[.]com/upd, retrieved consa[.]zip (SHA256: 59906b022adfc6f63903adbdbb64c82881e0b1664d6b7f7ee42319019fcb3d7e), side-loaded wmsgapi.dll via consent.exe, and ultimately deployed CastleRAT.
Sophos observed Shanya globally during 2025, with relatively higher prevalence in Tunisia and the United Arab Emirates, and detections in China concentrated around Shenzhen. The reporting characterizes Shanya as taking over part of the role previously played by HeartCrypt in enabling malware delivery and defense evasion for multiple criminal operators.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
It's possible to load your file in the context of another process, but it takes time to find vulnerabilities in the right software and time for testing.
Stealth
6 techniques
Stealth
It drops two kernel drivers: ThrottleStop.sys/rwdrv.sys (legitimate driver from TechPowerUp, abused in this context) hlpdrv.sys (a malicious unsigned kernel driver).
The loader code is highly obfuscated, with miles of junk code such as this.
Shanya dynamically resolves required Windows API functions by first parsing the PEB... Using a custom hashing algorithm, it then parses all export names until a match is found. That algorithm varies from sample to sample.
It's possible to load your file in the context of another process, but it takes time to find vulnerabilities in the right software and time for testing.
Anti-VM, doesn't run in sandboxes, doesn't unpack in the cloud.
By triggering the function with an invalid context, the malware attempts to induce an unhandled exception or crash if running under a user-mode debugger, thereby disrupting automated sandboxes and terminating manual analysis attempts before the payload can be fully executed.
Discovery
2 techniques
Discovery
Anti-VM, doesn't run in sandboxes, doesn't unpack in the cloud.
By triggering the function with an invalid context, the malware attempts to induce an unhandled exception or crash if running under a user-mode debugger, thereby disrupting automated sandboxes and terminating manual analysis attempts before the payload can be fully executed.
Command and Control
2 techniques
Command and Control
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A sophisticated multi-stage loader side-loaded as msimg32.dll that evades user-mode hooks, suppresses ETW, uses SEH/VEH-based control-flow obfuscation, decrypts and executes payloads in memory, and ultimately loads an EDR-killer used in Qilin ransomware attacks.
Shanya is a packer-as-a-service (PaaS) malware that provides obfuscation and EDR-killing capabilities to ransomware groups. It drops a clean driver and a malicious unsigned kernel driver to terminate and delete security products, enabling ransomware to evade detection and successfully execute.
A packer-as-a-service used to decrypt and load malware, including EDR killers and RATs, and used in multiple ransomware operations.
Shanya is a packer-as-a-service platform that provides cybercriminals with tools to obfuscate and package malicious payloads, enabling them to evade detection by security tools and antivirus engines. It is used to deploy ransomware and EDR killer payloads, often by inserting the payload into a memory-mapped copy of a legitimate Windows DLL, and includes anti-analysis features.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.