TL;DR

• MIMIC (Windows ransomware): Derived from leaked Conti source code and uses Everything for fast file discovery before encrypting data with ChaCha20. Abuses PowerShell, CMD, services, registry keys, and IFEO hijacking, while disabling Defender, deleting shadow copies, and forcing High Performance mode to speed up encryption and block recovery.
• CrystalX (Windows RAT): Combines remote access features with prankware-style visual effects and disguises its persistence as NVIDIA-like scheduled tasks. Uses mutexes and scheduled tasks for anti-relaunch and persistence, while maintaining C2-based remote control.
• Trojanized Telnyx Package: A supply-chain compromise in the Telnyx Python SDK where unauthorized PyPI releases executed malicious code on import. The malicious package used WAV-based payload delivery, dropped persistence on Windows, and exfiltrated credentials through HTTP.

1) MIMIC (Windows)

Sample: ANY.RUN

MIMIC is a ransomware strain derived from leaked Conti source code. It leverages the legitimate Everything utility API for rapid file searches and uses ChaCha20 for encryption. The malware actively cripples system recovery by deleting VSS shadows, disabling Windows Defender, and modifying system power settings to maximize data destruction speed.

How to detect: Detected by monitoring abnormal file and command-line activities and mutexes.

Key facts:

• Everything integration for fast target file discovery.
• Conti-based core with ChaCha20 + ECDH encryption.
• Defense evasion by disabling Windows Defender via PowerShell and terminating 50+ security, database, and related services.
• High-Performance mode is forced through Windows power plan changes to maximize encryption speed and prevent hibernation or reboot.
• Anti-recovery behavior includes deleting shadow copies, system backups, and disabling automated repair.
• LotL tactics rely on legitimate third-party binaries to bypass static analysis and EDR detection.

Analytical note:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion	VT First Submission
2026-04-08	-	2026-04-09	0	2026-04-08

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: filePath:".a2290u_p2k$"

IOCs:

• SHA256: 5a4be7cb16147df1b37015d912183431e3fc98c0d7b52d736849d1fea93f5ac5

MITRE:

Technique ID	Technique Name	Evidence
T1059.001	Command and Scripting Interpreter: PowerShell	Starts POWERSHELL.EXE for commands execution.
T1059.003	Command and Scripting Interpreter: Windows Command Shell	Starts CMD.EXE for commands execution.
T1569.002	System Services: Service Execution	Starts NET.EXE for service management.
T1543.003	Create or Modify System Process: Windows Service	Creates or modifies Windows service.
T1546.012	Event Triggered Execution: Image File Execution Options Injection	Modifies IFEO debugger key to hijack process execution.
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Changes the autorun value in the registry.
T1112	Modify Registry	Modifies different registry values.
T1562.001	Impair Defenses: Disable or Modify Tools	Changes Windows Defender settings.
T1012	Query Registry	Reads different registries.
T1082	System Information Discovery	Reads different system data.
T1518.001	Software Discovery: Security Software Discovery	Enumerates installed security software.
T1486	Data Encrypted for Impact	Encrypts files for impact.
T1490	Inhibit System Recovery	Deletes shadow copies or disables system recovery.

2) CrystalX (Windows)

Sample: ANY.RUN

CrystalX is a RAT with elements of prankware, combining classic remote administration features with visible and distracting effects on the victim system. It allows the operator to control the system, execute commands, and collect data while also displaying visual or disruptive effects, which makes it different from typical silent RAT tooling.

How to detect: Detected by mutex artifacts and scheduled-task creation, especially Global\WinSecMutex_*, Global\RtSyncMutex_*, and NvContainerTask_*.

Key facts:

• Combines RAT functionality and prankware effects.
• Allows remote command execution and system control.
• Uses mutex objects to prevent repeated execution.
• Persists through scheduled tasks masked as legitimate tasks.
• Can display visual or destructive effects to the user.
• Masquerades as system or NVIDIA-like tasks.

Analytical note:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion	VT First Submission
2026-04-01	securelist.com	2026-04-07	14	2026-04-03

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: syncObjectName:"Global\\WinSecMutex_" OR syncObjectName:"Global\\RtSyncMutex_" OR commandLine:"schtasks /Create /TN NvContainerTask_*"

IOCs:

• Mutex: Global\WinSecMutex_*
• Mutex: Global\RtSyncMutex_*
• Scheduled task: NvContainerTask_*

MITRE:

Technique ID	Technique Name	Evidence
T1053.005	Scheduled Task	Creates tasks NvContainerTask_* for persistence.
T1059	Command and Scripting Interpreter	Executes attacker commands on infected host.
T1105	Ingress Tool Transfer	Receives commands/modules from C2.
T1027	Obfuscated/Hidden Artifacts	Uses randomized mutex and task names.
T1491	Defacement / Impact	Displays prank or visual effects on the victim system.
T1071	Application Layer Protocol	Communicates with C2 for remote control.

3) Trojanized Telnyx Package (Win/Mac/Linux)

Sample: ANY.RUN

Trojanized Telnyx Package is a supply-chain compromise where the Telnyx Python SDK was briefly trojanized on PyPI. Two unauthorized releases, 4.87.1 and 4.87.2, were published and contained malicious code, while the upstream platform, APIs, and infrastructure were not compromised. The compromised versions were removed the same day.

How to detect: Detection based on identifying malicious package versions, import-triggered activity, and runtime communication with the observed C2 infrastructure 83.142.209[.]203:8080.

Key facts:

• The malicious releases were telnyx==4.87.1 and telnyx==4.87.2; both were unauthorized PyPI publishes and both contained injected code in telnyx/_client.py.
• The payload executes automatically on import telnyx, so no explicit function call is required.
• The attacker iterated quickly: 4.87.1 contained a casing bug that broke one execution path, while 4.87.2 fixed it.
• The Windows branch drops a persistent executable named msbuild.exe into the Startup folder.
• The Linux/macOS branch harvests credentials, encrypts them, and exfiltrates them over HTTP POST.
• The malicious code uses WAV steganography as a delivery mechanism: it fetches audio files from attacker infrastructure, decodes a payload using base64 plus XOR, and executes it.
• Observed infrastructure included 83.142.209[.]203:8080, payload paths such as /ringtone.wav and /hangup.wav, and the exfiltration header X-Filename: tpcp.tar.gz.

Analytical note:

Detected	External sources	ANY.RUN Last Submission	Sandbox Evasion	VT First Submission
2026-04-02	telnyx.com	2026-04-02	6	2026-04-02

With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.

TI Lookup: sha256:"7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9" or sha256:"cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3" or sha256:"23b1ec58649170650110ecad96e5a9490d98146e105226a16d898fbe108139e5" or sha256:"ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e"

IOCs:

• SHA256: 7321caa303fe96ded0492c747d2f353c4f7d17185656fe292ab0a59e2bd0b8d9
• SHA256: cd08115806662469bbedec4b03f8427b97c8a4b3bc1442dc18b72b4e19395fe3
• SHA256: 23b1ec58649170650110ecad96e5a9490d98146e105226a16d898fbe108139e5
• SHA256: ab4c4aebb52027bf3d2f6b2dcef593a1a2cff415774ea4711f7d6e0aa1451d4e
• IP: 83.142.209.203:8080

MITRE:

Technique ID	Technique Name	Evidence
T1195.001	Supply Chain Compromise: Compromise Software Dependencies and Development Tools	Malicious versions were published to PyPI under the legitimate package name.
T1059.006	Command and Scripting Interpreter: Python	Malicious code is injected into a Python SDK and executes on import telnyx.
T1105	Ingress Tool Transfer	The payload downloads a second-stage binary from attacker infrastructure.
T1027	Obfuscated Files or Information	The payload is hidden in WAV audio and decoded with base64 plus XOR.
T1547.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Windows branch persists by placing msbuild.exe in the Startup folder.
T1041	Exfiltration Over C2 Channel	Credentials are encrypted and exfiltrated via HTTP POST.

Conclusion

• MIMIC is most clearly identified by the Everything abuse pattern, the .a2290u_p2k$ artifact, and its aggressive recovery disruption behavior.
• CrystalX is easiest to hunt through its mutex patterns and fake NVIDIA-style scheduled task names.
• Trojanized Telnyx Package stands out as a supply-chain compromise, with the strongest indicators being the unauthorized PyPI versions, import-triggered execution, and the 83.142.209[.]203:8080 infrastructure.
• Across the three cases, the strongest detection approach is to combine host artifacts, command lines, and persistence behavior with the network and package indicators listed above.