cipher.exe — Malware Profile

cipher.exe is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).

MITRE ATT&CK techniques (1)

• T1561.001 Disk Content Wipe

Attributed threat actors

• APT28

Read the full analysis on IntelFusions