NetWalker, also known as Mailto, is a ransomware family and ransomware-as-a-service operation associated with targeted attacks against organizations. Operators combined file encryption with theft of sensitive data, turning an incident into both an availability crisis and a potential data breach.
NetWalker is primarily a historical family name, but affected systems and old evidence still require careful recovery. Similar intrusion methods remain common across current ransomware operations.
How NetWalker attacks progressed
- Attackers gained access through phishing, exposed remote services, stolen credentials, or vulnerable internet-facing systems.
- They collected credentials, mapped the network, and identified valuable servers, backups, and administrator accounts.
- Data could be staged and removed before encryption.
- Security and recovery controls were weakened where possible.
- The ransomware payload was deployed across selected systems, sometimes using scripts or memory-based execution.
- Victims received a ransom note and could face threats to publish stolen data.
Encryption is the visible final stage. Earlier identity and network evidence is essential for understanding the full compromise.
How to identify a possible NetWalker incident
- A security alert specifically naming NetWalker, Mailto, or associated PowerShell behavior.
- Files suddenly receive an unfamiliar extension and no longer open.
- Ransom notes appear in multiple directories.
- PowerShell or another scripting engine runs encoded or unusual commands from an unexpected parent process.
- Privileged accounts connect to many systems or shared resources outside normal administration.
- Large archives, data-staging directories, or unusual outbound transfers appear before encryption.
- Backups, shadow copies, security tools, or recovery settings are altered.
Extensions and note names can vary. Identify ransomware through multiple artifacts, not one filename copied from an online guide.
Immediate containment
- Isolate affected systems and network segments. Disconnect shared storage when it is being encrypted, but avoid wiping systems or destroying volatile evidence.
- Activate incident response and establish secure communications outside the affected environment.
- Disable compromised accounts and remote access while preserving authentication evidence.
- Protect backup systems by restricting access from the compromised domain and rotating backup credentials from clean devices.
- Preserve evidence: ransom notes, encrypted samples, suspicious scripts, process data, event logs, VPN records, identity logs, and transfer history.
- Search for the initial access path and other affected hosts before beginning broad restoration.
Data-theft assessment
Restoring encrypted files does not answer whether information was stolen. Review:
- access to file servers, databases, email, cloud storage, and backup repositories;
- creation of large archives and staging folders;
- uploads to cloud services, file-transfer tools, or unusual external hosts;
- access by compromised administrator and service accounts;
- legal, contractual, privacy, and regulatory notification requirements.
Handle data exfiltration as a separate incident workstream even when recovery from backup succeeds.
Recovery options
| Option | Important limitation |
|---|---|
| Restore from backup | The backup must be clean, protected from attacker access, and tested before production use. |
| Use a decryptor | It must support the exact variant and key situation; a tool for another family can damage files. |
| Rebuild systems | Applications, identity, and configuration must be restored without reintroducing persistence. |
| File repair or data reconstruction | Partial recovery may be possible from unaffected copies, exports, email, snapshots, or application-level replicas. |
Keep untouched copies of representative encrypted files and ransom notes before testing recovery. Use recognized law-enforcement, security-vendor, or established ransomware-recovery projects to check for a legitimate decryptor. Avoid unknown tools and services that demand an advance payment or upload of sensitive data.
Why paying is risky
A payment does not guarantee a working key, safe decryptor, complete data deletion, or protection from another demand. It may also create sanctions and legal concerns. Coordinate with legal counsel, insurers, law enforcement, and qualified incident responders.
Prevent similar ransomware intrusions
- Patch internet-facing services and remove unused remote-access exposure.
- Require phishing-resistant MFA for VPN, email, cloud, and privileged administration.
- Use separate administrator accounts and restrict lateral movement.
- Monitor scripting, credential access, archive creation, remote tools, and backup-console activity.
- Maintain offline or immutable backups with separate credentials and tested restoration procedures.
- Prepare a ransomware response plan that includes business operations, communications, privacy, legal, and recovery.
Frequently asked questions
Are NetWalker and Mailto the same ransomware?
Mailto is an alternate name associated with NetWalker. Researchers and security products may use different labels for samples and activity.
Can NetWalker files always be decrypted?
No. Recovery depends on the exact variant, key handling, available backups, and whether a trusted decryptor exists. Never test an unverified tool on the only copy of encrypted data.
Does removing NetWalker restore files?
No. Removing the executable can stop further malicious activity but does not reverse completed encryption. The broader intrusion, stolen credentials, persistence, and possible data theft must also be addressed.