HiddenTear

HiddenTear is an open-source proof-of-concept ransomware family for Microsoft Windows that became widely reused and adapted by criminal actors after its public release. Although presented as educational code, it has served as the basis for numerous real-world ransomware variants and derivative families, lowering the barrier to entry for less sophisticated operators and enabling rapid creation of custom extortion malware.

HiddenTear is designed to encrypt victim files and demand payment for decryption. Public reporting and malware analyses link it to many repurposed strains, including variants used in themed phishing campaigns and later ransomware families such as Ranion and Sorry HT. Derivatives and samples bearing HiddenTear signatures have also appeared in broader criminal infrastructure, including command-and-control ecosystems associated with financially motivated actors. In some observed cases, samples carrying HiddenTear signatures did not proceed to encrypt files during sandbox execution, indicating that signature overlap, incomplete builds, or repurposed artifacts can occur.

The family primarily targets Windows systems and is commonly associated with file encryption behavior, ransom-note deployment, and straightforward implementation patterns that make it attractive for modification. Analyses of HiddenTear-derived samples have also documented common commodity-malware enhancements such as obfuscation, packing, anti-debugging, self-deletion, and process hollowing or RunPE-style execution in some variants. Delivery has been observed through malicious documents in phishing campaigns, including socially engineered lures such as COVID-19-themed messages, while the source code has also been incorporated into ransomware-as-a-service and other derivative operations.

HiddenTear is significant less for technical sophistication than for its ecosystem impact. Its public availability helped normalize reuse of open ransomware code, and it is frequently cited as a canonical example of how proof-of-concept extortion malware can be operationalized at scale by unrelated threat actors.