VILE Ransomware Broad-Spectrum File Encryption: DICOM, Terraform, Parquet, Docker

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects high-volume file modification or renaming operations targeted at specific file extensions (dcm, tf, parquet) commonly associated with sensitive data (DICOM imaging, Terraform states, database parquet files) or operations occurring within Docker volume directories. The detection uses an aggregation logic to identify when a process performs more than 20 such file operations on an endpoint, which may indicate bulk data exfiltration, encryption, or tampering.