Troldesh / Shade ransomware

Troldesh, also known as Shade or Encoder.858, ran from 2014 until its operators stopped at the end of 2019 and, in April 2020, released more than 750,000 keys. Kaspersky's free ShadeDecryptor, listed on No More Ransom, covers files ending .xtbl, .ytbl, .breaking_bad, .heisenberg, .better_call_saul, .los_pollos, .da_vinci_code, .magic_software_syndicate, .windows10, .windows8, .no_more_ransom, .tyson, .crypted000007, .crypted000078, .dexter, .miami_california, .rsa3072 and .decrypt_it; Bitdefender publishes a decryptor for the same eighteen. Builds with any other suffix, such as the early .cbtl, are not on either list. Encrypted names are replaced by a Base64 string carrying the victim ID, about ten identical README notes in Russian and English are dropped per folder, the Volume Shadow Copy store is wiped and a new desktop background is set. Spam with fake invoices or bank and court notices, plus exploit-kit links, carried it mainly to Russian-speaking Windows users, and some waves installed password stealers or remote-access tools alongside it.

Sources: In-house research

File extensions: .better_call_saul, .breaking_bad, .crypted000007, .crypted000078, .da_vinci_code, .daria, .decrypt_it, .dexter, .fucking, .heisenberg, .los_pollos, .magic_software_syndicate, .miami_california, .no_more_ransom, .rsa3072, .tyson, .windows10, .windows8, .xtbl, .ytbl

Ransom note filenames: How_to_decrypt.txt, How_to_mod_files.txt, README1.txt

Decryptor: A free decryptor is available. Checked 2026-10-28.

Data exfiltration risk: Undocumented — Shade itself encrypts and demands payment without any leak threat, and no leak site exists. It was sometimes delivered alongside other malware, including credential stealers and remote-access tools, so a separate compromise of stored credentials should be considered.

Systems typically targeted: Windows PCs and servers, at first mostly in Russia and other Russian-speaking countries, later spreading further after early 2019. Infection came through spam with malicious attachments and links to exploit-kit sites.

Do this first: The operators released their keys in April 2020, and the free Kaspersky and Bitdefender tools recover files carrying any of the 18 listed extensions. Builds with other extensions are not covered, so keep those files. Look for password stealers or remote-access tools installed alongside Shade and change credentials used on the machine.

Link to decryptor: No More Ransom