Mamba
Mamba is a ransomware group with a financial motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 4 countries, including the United States and India.
- HDDCryptor
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Sep 1, 2016
- Last seen
- Mar 1, 2021
- Record updated
Who They Target.
About Mamba.
Mamba (also known as HDDCryptor or HDD Cryptor) is a full disk encryption ransomware first discovered in September 2016 by Morphus Labs researchers in Brazil. The malware weaponizes the legitimate open-source tool DiskCryptor to encrypt entire drives, including the operating system, using XTS-AES encryption. It overwrites the Master Boot Record (MBR) with a custom bootloader to display the ransom note, rendering systems unbootable. Mamba also encrypts network shares via SMB and uses tools like Netpass and PsExec for lateral movement. Notable victims include a Brazilian energy sector company with U.S. and India subsidiaries (September 2016), and the San Francisco Municipal Transportation Agency (SFMTA, November 2016), where over 900 PCs were affected and the agency offered free rides during recovery. In 2017, attacks were observed against organizations in Brazil and Saudi Arabia. According to a March 2021 FBI FLASH alert, Mamba has been deployed against local governments, public transportation agencies, legal services, technology services, and industrial, commercial, manufacturing, and construction businesses.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.