Draft:CompiledCrypt

• Comment: Not notable. Accesscrawl (talk) 11:32, 20 September 2026 (UTC)

• Comment: notability has not been shown yet, subject needs to be shown to have receive significant coverage in multiple independent reliable sources Giulio 13:45, 18 September 2026 (UTC)

---

CompiledCrypt

CompiledCrypt
A start up of what you first see when starting CompiledCrypt.
Malware details
Type	Ransomware/Wiper
Family	CompiledCrypt
Cyberattack event
Target	Files in Windows user directories (Desktop, Documents, and Downloads)
Technical details
Filename	MSEdge.exe, Edge.exe
Filetype	EXE
Size	3–8 MB
Written in	C++

CompiledCrypt is a provisional designation for a Windows ransomware program identified in multiple malware samples. The program targets files in common user directories and encrypts their contents using the Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM).

Behavior

CompiledCrypt targets files located in the user's Desktop, Documents, and Downloads directories. The analyzed program reads the files and combines their contents into a single data buffer before encrypting the resulting data.

The encrypted data is saved as compiled.enc. A README.txt file is also created containing a ransom demand.

After processing a directory, the program deletes the original regular files while leaving the encrypted output and ransom note. First observed on September 13, 2026, CompiledCrypt has been confirmed on five computers, while additional malware samples associated with the program continue to be identified.

Damage

CompiledCrypt can result in the loss of files stored on an affected computer. The analyzed samples encrypt files and subsequently delete the original files. Because the analyzed implementation does not appear to preserve or transmit the encryption keys, recovery of affected files may not be possible using the program itself.

Five computers have been confirmed as having executed a CompiledCrypt sample. At least three reported incidents involved ransom demands of US$100 worth of Bitcoin.

Encryption

The analyzed implementation uses AES-256-GCM encryption. A randomly generated encryption key and initialization vector are created during execution.

The implementation also generates a GCM authentication tag. In the analyzed sample, however, the encryption key and authentication tag are not stored with the encrypted data or otherwise made available for recovery.

Persistence

The program copies its executable into the Windows Startup folder. This causes the executable to be launched when the affected user logs into Windows.

Naming

"CompiledCrypt" is a provisional research designation referring to the program's use of a file named compiled.enc and its aggregation and encryption of files.