LCRYX Ransomware Sequential Defense Dismantling via Registry, Netsh, and Taskkill

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.