Take a “NetWalk” on the Wild Side

This McAfee Advanced Threat Research report analyzes NetWalker (Mailto) ransomware, describing its development into a Ransomware-as-a-Service operation, technical behaviors (RC4/ Salsa20 encryption, reflective DLL injection, resource-based config, shadow copy deletion), victim interaction changes (email to Tor portal), delivered decryptor behavior, underground advertising and affiliate model, and blockchain tracing of payments (approximately 2,795 BTC / ~$25M between March–July 2020); the report includes IOCs, YARA rules, and a mapped set of MITRE ATT&CK techniques.