MetaEncryptor Ransomware: LostTrust Ties, IOCs, and Response

MetaEncryptor ransomware is a double-extortion operation first recorded by most leak-site trackers in August 2023 and closely linked to LostTrust, a short-lived ransomware brand from the same year. The encryptors described so far target Windows, and the group threatens to publish stolen data on its Tor leak site. It posted new claims there as recently as November 2026, but no reported 2026 case confirms that it still encrypts files.

If MetaEncryptor has listed your organization or encrypted your files, contact Proven Data's incident response team before engaging the group.

MetaEncryptor ransomware at a glance

What is MetaEncryptor ransomware?

MetaEncryptor is a ransomware group known mainly through its leak site. Windows files tied to its name from 2022-2023 are based on the older SFile encryptor, as is LostTrust.

The group's start date is unclear, but a file referencing its ransom note name surfaced in September 2022. Most trackers first recorded its leak site about a year later, in mid-August 2023, when it already listed about a dozen organizations, some for incidents from months earlier. New listings appeared irregularly after that, most recently in November 2026, so the group is still active, at least on its leak site.

Who runs MetaEncryptor, and from which country, is unknown. So is whether it runs a ransomware-as-a-service affiliate program: no recruitment ad has surfaced. As of November 2026, no arrests, charges, seizures, or government advisories on the group have been made public.

Who MetaEncryptor claims as victims and what those organizations say

The MetaEncryptor leak site names organizations across many sectors, most often manufacturing. Early listings were mostly European, especially German, and since 2024 the largest share has been in the US.

Trackers recorded more than 25 new MetaEncryptor listings between September and early November 2026, including large companies in engineering, construction, energy, manufacturing, and healthcare.

Victim listings on ransomware leak sites represent unverified claims made by the threat actor. Treat them as unconfirmed unless company disclosures, SEC filings, regulatory notifications, or law enforcement confirm them.

No listed organization has publicly confirmed MetaEncryptor as the attacker, although about a dozen have reported an incident or responded to the claim. In most of these cases, the only link to the group is its own listing. Five cases show the range, from encrypted files and a ransom note reportedly in the group's name to no evidence of access:

• Münchner Verlagsgruppe, August 2023. Staff at the Munich publisher found a ransom note on their screens, and the local daily Abendzeitung reported that the attackers called themselves "Metaencrypter." The company said most data was deleted and the rest encrypted, and it refused to pay. Prosecutors treated the incident as a ransomware attack. The publisher warned authors and business partners of possible misuse. A spokesperson told the news agency dpa it did not assume the data had been copied but could not rule that out, while the newspaper reported data had apparently been stolen.
• Trailer Transit, September 2025. The US trailer transport company says attackers took internal memos, held the data under what it calls a "ransomware protocol," and released it publicly. The memos may have included names, birth dates, contact details, and Social Security numbers. The company offered free credit monitoring.
• Corona Corporation, reported August 2026, updated October 2026. The Japanese heating equipment maker found files online that matched those it stores in an external cloud service. It says a third party most likely used leaked credentials for one account, which had no MFA and a weak password. Names, addresses, phone numbers, and installation documents of about 24,000 people may be affected. Corona reset all accounts on the service, turned on MFA, and plans to contact those affected.
• Astemo, September 2026. The auto parts supplier says a contractor employee's account was compromised and used to reach a cloud data-sharing environment. Around September 2, the account showed login anomalies and unexpected MFA prompts. On September 17, a third party claiming to hold Astemo's data contacted employees and suggested it could be made public. Five days later, Astemo confirmed that a claim naming it had appeared on a third-party website. The exfiltrated data includes contact details of about 350 employees, supplier staff, and contractors, but no personal data of customers' staff or end consumers. Astemo was still reviewing the wider impact as of October 16 and had found no signs of ransomware or internal network compromise. It suspended the contractor's accounts and reported the case to police and other authorities.
• MyMichigan Health, October 2026. The Michigan health system says a group calling itself MetaEncryptor claimed it stole data but provided no samples. As of October 15, the health system had found no evidence of unauthorized access or compromised patient data. It hired an outside incident response firm and is working with law enforcement.

A listing alone does not show which of these cases applies to your organization; only your own investigation can.

How MetaEncryptor applies pressure: leak site and ransom note

A MetaEncryptor listing can bring class-action lawyers and lawsuits even if the claim is never verified, while most of the group's own threats have not been reported as carried out.

What the group threatens

The leak site says a new listing comes with a file list and samples, part of the data follows if the organization misses its deadline, and the rest goes public after that. At that last step, the site threatens "formal notifications" to the FTC, the SEC, and seven European and Asian data protection bodies (ICO, CNIL, BfDI, EDPB, PDPC, PIPC, PPC).

The 2025 build's ransom note adds threats of data sales and further attacks on the organization, its partners, and its suppliers, and warns of lawsuits over the breach. It gives 24 hours to make contact and offers to decrypt a couple of files up to 5 MB for free.

In its claim of an attack on EllisDon, a Canadian construction company, the group went further. It told a security blog that without a deal by its deadline, it would contact thousands of potentially affected people, notify competitors, and pass the data to class-action law firms.

In return for what it calls a "mutual agreement," the site promises to destroy every file and remove the listing, but deletion of stolen data cannot be verified. A removed listing may not stay removed. Some have left the site and later returned with a new deadline.

What has been reported: data releases and class actions

Of the cases above, Corona and Trailer Transit report that data was released, and Astemo's employees were contacted. None of the three organizations name the group. No source reports the group notifying a regulator or attacking an organization again.

Law-firm pages seeking plaintiffs appeared the same day or within days of several listings, in one case two days before the organization's statement. Most of these pages cite tracker posts rather than a confirmed breach.

Federal class actions can follow as fast: by ransomware.live's dates, a suit against AECOM came six days after its MetaEncryptor listing and a suit against Flex three days after. Both complaints share a law firm and cite tracker posts about the listings, and the Flex suit was voluntarily dismissed about a month later. A complaint is only an allegation, and nothing found ties the law firms to the group.

Involve counsel as soon as your organization is listed.

Does MetaEncryptor still encrypt files?

It is unknown whether MetaEncryptor still encrypts files: no new build from 2026 has been found, and no reported 2026 case confirms encryption. Earlier evidence points to encryption. In 2023, German newspapers reported that two companies on its leak site had data encrypted or deleted. One investigation published in 2024 describes encrypted VMs and local files, and a vendor describes a 64-bit encryptor it received in February 2025.

In 2026, the group said it did not encrypt EllisDon's files. That is one claim about one organization, not a reason to treat MetaEncryptor as data theft only. Plan for both a data breach and a ransomware attack.

As of November 2026, no known public file both encrypts and uses the MetaEncryptor note or extension. The files below are tied to MetaEncryptor or share its SFile-based code.

In sandboxes, the 2022-2023 files write decryptor.log and try to delete the note in each folder instead of creating it. The 2023 file often cited as MetaEncryptor's encryptor also logs METADECRYPTING and embeds a private RSA key. No reverse-engineering analysis of these files is available, so their origin and purpose are unconfirmed. Do not run them on encrypted data. The recovery section explains why.

Encryption scheme, network shares, and hypervisors

The most detailed published encryption analysis of this SFile-based code, from SK Shieldus, covers a sample sharing the July 2022 build's note and extension, not MetaEncryptor's. It describes AES-256 CBC for file contents, with the key protected by RSA-2048 and stored inside each encrypted file. Files larger than 16 bytes and up to 10 MB are encrypted whole, and larger files get partial or intermittent encryption, depending on size. Whether the 2025 build works the same way is unknown.

That sample encrypts mapped network drives by default, and --enable-shares extends it to network shares. The 2025 build's option list suggests it encrypts SMB shares unless --disable-shares is set. No self-propagation mechanism has been described.

No Linux or ESXi build has been tied to this group, but that does not clear hypervisors. The older SFile family had Linux and FreeBSD variants by early 2022, and the investigation published in 2024 describes VMs encrypted at the hypervisor level, without saying how. Include hypervisors when scoping an incident.

Is LostTrust ransomware a MetaEncryptor rebrand?

LostTrust ransomware is closely tied to MetaEncryptor, but a simple rebrand does not explain the link. Reporting in 2023 called LostTrust a likely rebrand, while SentinelOne described it as an evolution of SFile and Mindware. For a responder, a LostTrust or SFile detection points to shared SFile-based code, not to a specific operator.

The timeline:

• February 2020: SFile, also known as Escal, is first seen in attacks.
• 2022: Mindware appears and overlaps strongly with SFile, either as a rebrand or through access to the same source code or builder. The July 2022 build shows this code in use with Mindware's infrastructure. Its note points to a chat on Mindware's onion address.
• August 2023: Trackers record MetaEncryptor's leak site.
• September 26, 2023: Trackers first record LostTrust's site, already with 53 listings. It reuses MetaEncryptor's site template and, almost word for word, its "about" text, and lists the same Tox ID.
• Around the start of October 2023: Both sites are up for at least a week.
• Early November 2023: LostTrust has added nothing after its first 53 listings, and trackers show its site offline, for reasons unknown.
• November 2026: Trackers still record no new LostTrust listing.

A LostTrust sample and the 2023 file often cited as MetaEncryptor's encryptor were reported as nearly identical, with differences mainly in notes, embedded keys, and extensions. Since that file behaves like a decryptor, the match shows shared code, not a confirmed MetaEncryptor encryptor. Code can be sold or passed on. Nothing shows that the same people wrote SFile, ran Mindware, or run MetaEncryptor today.

The reused site template proves little, since templates are easy to copy; the shared Tox ID is the stronger link, though it does not prove common operators.

If LostTrust were simply MetaEncryptor under a new name, the old name would likely have gone quiet. Instead, MetaEncryptor kept adding listings into 2026, and LostTrust took over none of its listings. That does not rule out a shared owner, but it is safer to treat LostTrust as a related brand than as another name for the same operation.

LostTrust's first list included organizations already listed by other groups, such as Royal and LockBit. On its own, a LostTrust listing says little about who attacked an organization.

MetaEncryptor attack chain and MITRE ATT&CK mapping

How MetaEncryptor gets in has not been established. Astemo and Corona, both on its leak site, point to a compromised account used to reach a cloud service and download data, but neither names the group. The group claims it accessed EllisDon's systems through an unnamed zero-day around July 2026.

The only detailed public account of an intrusion is a 2024 HiSolutions report on an incident involving MetaEncryptor deployment and the CSHARP-STREAMER remote access trojan. It names neither the organization nor the date of the incident. The authors suspect an initial access broker, without saying where its work ended. From their own casework, they assume MetaEncryptor has a special interest in IT service providers. The same RAT has appeared with REvil, ALPHV, and TA866, so finding it does not point to this group.

Privilege escalation, persistence, and exfiltration are not documented either. The closest clues to what could be taken are the cloud downloads above, plus the KeePass searches and cloud-folder listings in that report.

The table combines the 2024 report with "Related samples": the July 2022 build and the 2023 LostTrust samples, which use neither the MetaEncryptor note nor its extension. The 2024 report rows draw on the authors' own ATT&CK mapping, adapted to v20, and the Related samples rows are an editorial mapping. ATT&CK itself does not list the group, its encryptors, or CSHARP-STREAMER.

No public case describes an EDR bypass. The closest evidence is the AMSI patch and the 2025 build's --kill-processes option, which ends non-Windows processes but is off by default and not seen in use.

The related samples stop and disable database, mail, and application services, including an Exchange backup component, with living-off-the-land binaries such as WMIC. The 2025 build's description lists the same service names, none of them a security product, and says "Disables AV" without showing how.

MetaEncryptor IOCs and detection

No file or behavior indicator below is tied to a 2026 intrusion, so treat them as historical. A hash match does not prove this group attacked you, and the absence of one does not clear it. Public IOC lists and group profiles need the same care. Some credit MetaEncryptor with other families' hashes, even the hash of an empty file, and with CVEs and tools that no observed case supports; those are left out here.

File and contact indicators

SHA-256 hashes

Several of these files carry a note addressed to one named organization, so the next target's file is unlikely to share a hash. No hash of the 2025 build, wallet address, unique mutex, or encryptor C2 is publicly known.

Behavior and detection rules

Use these behaviors to widen a hunt, not to name the attacker:

• Service-stop burst, the most distinctive (July 2022 build, LostTrust 2023). One parent process spawns cmd.exe /c WMIC SERVICE WHERE "caption LIKE '%...%'" CALL STOPSERVICE and CALL ChangeStartMode 'Disabled' for Firebird, MSSQL, SQL, Exchange, wsbex, postgresql, BACKP, tomcat, SharePoint, and SBS. The SQL command misspells the method as CALL STOPSERVIC. Match the misspelling at the end of the command line, because a plain substring search also hits every correct CALL STOPSERVICE.
• Event log clearing and shadow copy deletion (same files). wevtutil cl for Application, Security, Setup, and System, plus vssadmin.exe delete shadows /all /quiet. Both are common on their own and matter next to the burst above.
• Command-line flags (2025 build, one vendor). Search process command lines for --disable-shares, --kill-processes, --only-wait, --wait-mm, and the self-delete options --shred-at-end and --shred-now. No report shows them being used in an attack.
• CSHARP-STREAMER relay and partition formatting (2024 report). In the reported case, the RAT's TCP relay added a firewall rule named Inbound TCP Port 6667 with netsh.exe, which Windows logs as rule-added event 2004, 2071, or 2097. SigmaHQ's New Firewall Rule Added Via Netsh.EXE rule detects the netsh command itself. PsExec also ran format on secondary partitions.
• Note wording (2023 file, LostTrust x86 notes, 2025 note). Search file content for So we decided to change our business model. and This is serious business for us. The note's name can change, but this text has stayed.
• Strings for sample triage (SFile-based code, not specific to MetaEncryptor). METAENCRYPTING, ENCODED : %ws (total files : %d), decrypt file %ws, %ws, ! cynet ransom protection(don't delete), --enable-shares, --onlypath, and the PDB paths C:\fake_exe.pdb, C:\fake.pdb, and D:\fake.pdb.

The 2025 build has no known public detection rule. Endpoint tools may show only detection names such as Ransom:Win64/MetaEncryptor.SA!MTB or Ransom.Win64.METAENCRYPTOR.A. A public YARA rule for LostTrust requires .losttrustencoded, so it is unlikely to match the 2025 build, and it does not match the decryptor-like files. Malpedia's automatic YARA rule for MetaEncryptor skips files of 598,016 bytes or more, so it will not match the 1.39 MB 2025 build. A hit on this rule may be a decryptor-like file.

The HiSolutions report publishes a YARA rule for CSHARP-STREAMER and a Sigma rule for its PowerShell loader, and lists the RAT's user agent, websocket-sharp/1.0. The Sigma rule needs Script Block Logging (Event ID 4104) and matches public proof-of-concept code, so other loaders can trigger it.

The YARA rule expects an MZ header at offset 0 and looks for the decrypted RAT, which in known cases was loaded only in memory. A disk-only scan may miss it. Run the rule on PE modules dumped from memory, not on a raw memory image.

What to do if MetaEncryptor lists your organization or encrypts your files

Start containment under your response plan and call Proven Data for emergency incident response; the steps below cover what is specific to this group.

If your organization is listed

• Treat the listing as a claim to verify. Listings can carry errors, such as a misspelled domain. Have your response team compare whatever is posted with your own data. Do not plan around the countdown: some listings appear with a deadline that has already passed.
• Review sign-ins and downloads on cloud-sharing and contractor accounts first. They are the only entry paths described by listed organizations, and in one case, unexpected MFA prompts came about three weeks before the listing. Those prompts showed up in the contractor's own system. Ask contractors to preserve and review their logs. Also check internet-facing systems, since the group claims to have used a zero-day.
• Ask staff about outside contact. In the same case, a third party claiming to hold the data contacted several employees five days before the listing.
• Keep a chain of custody from day one for logs and anything collected from the listing: lawsuits have followed listings within days.

"Publication doesn't merely threaten regulatory exposure; it frequently starts it," says Magdy Abdelaziz, Proven Data's Head of DFIR. "GDPR's seventy-two-hour clock, the patchwork of US state breach laws, and sectoral regimes like HIPAA, GLBA, and the SEC's four-business-day disclosure rule for public companies all have their own triggers and deadlines, and counsel needs to determine which clocks are already running before they run out."

If files are encrypted

• Isolate affected systems from the network, then capture memory before shutting anything down, where possible. In the investigation published in 2024, the RAT was loaded only in memory. The 2025 note tells administrators not to stop processes, shut down servers, or unplug drives. Follow your own plan for isolating ransomware-infected servers, not the note.
• Isolate hypervisor management, backup systems, and backup repositories, then image hypervisor storage and secondary partitions before anything writes to them. In the same investigation, VMs were encrypted at the hypervisor level, and secondary partitions were formatted.
• Keep the encryptor, the note, and sample encrypted files as part of preserving ransomware evidence. With no public 2026 build known, your copy may be the only record of how this attack encrypts. Work on copies and leave encrypted originals unchanged, because the 2025 note says the keys are written to the end of each file.
• Build the timeline from forwarded logs. The July 2022 build timestomps files while encrypting, and the related samples clear four Windows event logs, so local timestamps and logs may be unreliable.
• Treat domain credentials as exposed. The investigation published in 2024 found AD queries, Kerberoasting, and searches for KeePass configuration files. Before reconnecting rebuilt systems, plan a coordinated reset of service-account and privileged passwords, and of vault secrets where exposure is suspected.
• Reset krbtgt if domain administrator access is suspected. Reset it twice, waiting at least the maximum ticket lifetime between resets (10 hours by default).

Can files encrypted by MetaEncryptor be recovered?

No free decryptor for MetaEncryptor, LostTrust, SFile, or Mindware appears in No More Ransom or other major decryptor catalogs as of November 2026, so recovery depends mainly on clean backups.

No weakness in their encryption has been publicly confirmed either. Ideally, restore from offline copies of whole VMs and secondary partitions. Check for surviving shadow copies, but do not count on them. The related samples delete them, and the vendor's description leaves it unclear whether the 2025 build does so by default.

Large files may be partly recoverable. In the analyzed SFile-based sample, files over 10 MB were only partly encrypted. The start of each file is always encrypted, so it will not open as is, but files over 100 MB keep more than 80% of their data intact. Because the 2025 build and hypervisor-level VM encryption may differ from that sample, treat this as a question for a specialist working with your own files, not a promise.

Do not run the decryptor-like files from public malware databases on your data. At least one embeds its own private RSA key, and nothing shows that key fits files from another build or organization. In sandboxes, these files also try to delete the ransom note in every folder, which would destroy evidence.

If backups are missing or incomplete, Proven Data's ransomware recovery team can assess what can still be restored from your own systems.

What is known about paying MetaEncryptor

No payment by a listed organization has been confirmed, so it is unknown whether the group delivers a working decryptor or deletes data afterward. The only reported ransom range, $100,000 to millions, comes from an unnamed source describing LostTrust in 2023.

None of the names MetaEncryptor, LostTrust, SFile, or Mindware appear on OFAC's sanctions list, but that does not clear a payment. The operators are unknown, and no public wallet address has been found to screen.

Older notes from SFile-based builds threatened to leak data if the organization hired outside negotiators or recovery firms. The vendor's screenshot of the 2025 note has no such line, and the group's 2026 contact page says it answers insurers handling ransomware incidents.

DO NOT PAY THE RANSOM. Decisions about ransom payment carry legal, operational, and financial consequences, including potential OFAC sanctions exposure, and should be assessed with qualified legal counsel and an incident response team before any decision to engage with or pay the threat actor. That assessment must not delay containment, evidence preservation, required reporting, or recovery.

Security checklist

• Require MFA on cloud-sharing and contractor accounts, and alert on unexpected MFA prompts and unusual downloads. Both entry paths described by listed organizations ran through such accounts, one of them without MFA.
• Keep hypervisor and backup administration out of the production domain, and hold offline copies of whole VMs and secondary partitions. In the investigation published in 2024, attackers encrypted VMs at the hypervisor level and formatted secondary partitions.
• Restrict PsExec and alert on new inbound firewall rules created by netsh.exe. The same attackers used PsExec to run commands and push the encryptor, and the RAT's relay added such a rule.
• Move service accounts to group managed service accounts (gMSAs), or give them randomly generated passwords of 25 or more characters. Those attackers also used Kerberoasting.
• Turn on PowerShell Script Block Logging and forward logs off the host. The RAT loader ran through PowerShell, and the related samples clear local event logs.