1. Executive Summary: The MAIN (Dharma) Threat

The ransomware ecosystem is heavily populated by legacy families that continue to wreak havoc through persistent, opportunistic attacks. Discovered in late 2026, the MAIN ransomware is a highly destructive iteration of the long-standing Dharma (also known as Crysis) ransomware family. Known for exploiting weak perimeter security, MAIN represents a significant threat to small and medium-sized enterprise networks.

Upon breaching a corporate network, the MAIN variant rapidly encrypts mission-critical data, appending a complex, multi-part extension to all impacted files. This extension structure includes a unique victim ID, the attacker’s contact email, and the .MAIN suffix. For example, a vital database originally named inventory.sql is rendered entirely inaccessible as inventory.sql.id-9ECFA84E.[[email protected]].MAIN.

Following encryption, the malware forces the deployment of a highly visible pop-up window (often utilizing an HTA application interface) and drops localized INFO.txt files to deliver their extortion demands. Unlike more modern RaaS syndicates that focus heavily on sophisticated double-extortion data exfiltration, Dharma variants like MAIN rely primarily on raw encryption and aggressive communication via email and Telegram (@MainpartVI) to force a swift payout.

This exhaustive playbook provides IT administrators, network engineers, and incident responders with a clear, actionable roadmap based on the NIST Incident Response framework. It details how to execute immediate containment, hunt for the remaining payload, navigate the extortion threat, and structurally secure the network against future intrusions.

2. Threat Intelligence & Technical Specifications

To successfully counter a Dharma ransomware deployment, defenders must understand the adversary’s technical footprint. The MAIN variant relies on brute-force tactics and manual network traversal rather than automated worm-like spreading.

3. Anatomy of an Attack (The RDP Kill Chain)

Dharma variants are notoriously opportunistic. They rarely rely on complex zero-day vulnerabilities, instead capitalizing on basic IT misconfigurations.

1. Initial Compromise (The Open Door): Attackers actively scan the internet for exposed Remote Desktop Protocol (RDP) ports (TCP 3389). They utilize automated brute-force tools (like NLBrute) to cycle through common administrative passwords until they achieve a successful login.
2. Manual Privilege Escalation: Unlike automated ransomware, Dharma operators often perform a “hands-on-keyboard” attack. Once logged into a workstation or server, they use tools like Mimikatz or Process Hacker to elevate privileges, disable active endpoint antivirus, and map the network.
3. Defense Destruction: Before launching the encryption payload, the attackers execute batch scripts to silently delete local Volume Shadow Copies (vssadmin.exe Delete Shadows /All /Quiet) and disable Windows Startup Repair to prevent easy system rollback.
4. Encryption & Extortion: The threat actors manually execute the MAIN payload. The malware encrypts the data, appends the complex .MAIN extension, drops the INFO.txt files, and forces an HTA pop-up window to appear on the victim’s desktop, locking the screen with their demands.

4. The Complete Ransom Note Analysis

During an active incident, the ransom notes are vital forensic evidence. MAIN utilizes a dual-note approach: a persistent pop-up window for immediate intimidation, and a minimalist text file. Below is the complete text of both.

The Pop-Up Window (HTA Interface)

All your files have been encrypted! Don’t worry, you can return all your files! If you want to restore them, write to the mail: [email protected] YOUR ID – If you have not answered by mail within 12 hours, write to us by another mail: [email protected] Free decryption as guarantee Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) TELEGRAM write to us by telegram: @MainpartVI Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

The INFO.txt File

You want to return? write email [email protected] or [email protected] or @MainpartVI

5. Phase 1: Detection & Threat Hunting

Upon discovering the .MAIN extension, rapid network-wide detection is required to identify all compromised assets and locate the initial payload. Security teams must sweep the environment to root out the executables.

Actionable PowerShell Threat Hunt

Deploy this PowerShell script via your centralized management console (e.g., SCCM, PDQ Deploy, or EDR Live Response) to audit endpoints for MAIN indicators:

# ==============================================================================
# Decryptors.org Incident Response Script: MAIN (Dharma) Audit
# Target: Windows Endpoints (Run as Administrator)
# ==============================================================================

Write-Host "Starting MAIN Network Audit..." -ForegroundColor Cyan

# 1. Check for encrypted file extensions in critical user directories
$testPaths = @("$env:USERPROFILE\Documents", "$env:USERPROFILE\Desktop", "C:\Data")
$infectionFound = $false

foreach ($path in $testPaths) {
    if (Test-Path $path) {
        $encryptedFiles = Get-ChildItem -Path $path -Filter "*.MAIN" -Recurse -ErrorAction SilentlyContinue
        if ($encryptedFiles.Count -gt 0) {
            Write-Warning "[!] CRITICAL: Encrypted .MAIN files detected in $path"
            $infectionFound = $true
        }
    }
}

# 2. Check for the presence of the specific ransom note
$ransomNote = Get-ChildItem -Path C:\ -Filter "INFO.txt" -Recurse -Depth 3 -ErrorAction SilentlyContinue | Where-Object { Select-String -Path $_.FullName -Pattern "MainpartVI" -Quiet }

if ($ransomNote) {
    Write-Warning "[!] CRITICAL: MAIN ransom note (INFO.txt) discovered."
    $infectionFound = $true
}

# 3. Check for suspicious VSS (Volume Shadow Copy) deletion events
try {
    $vssEvents = Get-WinEvent -LogName System -MaxEvents 200 -ErrorAction Stop | 
                 Where-Object {$_.Id -eq 7036 -and $_.Message -match "Volume Shadow Copy"}
    
    if ($vssEvents) {
        Write-Warning "[!] Warning: Shadow Copy service modifications detected in recent logs."
        Write-Warning "Threat actors likely executed VSS deletion commands to destroy local backups."
    }
} catch {
    Write-Output "[i] Could not parse Event Logs or no logs found."
}

if ($infectionFound) {
    Write-Warning ">>> IMMEDIATE ENDPOINT ISOLATION REQUIRED. DO NOT REBOOT. <<<"
} else {
    Write-Output "[i] No immediate signs of MAIN infection on this endpoint."
}

7. Phase 3: Cryptographic Triage & Recovery

Once absolute containment is verified and the initial access vector (exposed RDP) has been definitively patched, the organization can transition to the recovery phase.

Method 1: The Gold Standard - Restoring from Immutable Backups

The only mathematically guaranteed method for overcoming a modern Dharma attack is a full architectural restoration from verified, immutable, or completely air-gapped backups.

• The "Clean Room" Rebuild: Because Dharma operators utilize "hands-on" techniques, they frequently create secondary administrator accounts and hidden backdoors. You cannot simply delete the .MAIN files and assume the server is safe. Affected hard drives must be entirely formatted. Perform a bare-metal OS reinstallation on all impacted hosts.
• Active Directory Cleansing & Credential Rotation: Assume all Active Directory credentials are compromised. Force a global password reset for all users and service accounts. Audit AD for any recently created, unauthorized administrator accounts.
• Sequenced Restoration: Follow a strict cross-platform recovery map. Restore Domain Controllers first in an isolated, firewalled VLAN to establish clean DNS and authentication. Once stable, restore critical database servers, and finally, end-user file shares.

Method 2: Cryptographic Response & Handling Extortion

If your organization lacks immutable backups, the situation is severe. While some early versions of Dharma had flaws resulting in public decryptors, modern variants like MAIN utilize robust asymmetric cryptography. Brute-forcing the encryption key without the attacker's private key is mathematically impossible.

If an extortion payment is facilitated as an absolute last resort to recover mission-critical databases, you must utilize professional decryption tools operated by DFIR specialists. You must follow a strict, isolated automated decryption workflow:

1. Never decrypt on production hardware. The decryption tool provided by the threat actor may be bundled with secondary malware, data stealers, or logic bombs designed to trigger weeks later.
2. Clone the encrypted drives using professional forensic imaging software.
3. Mount the cloned drives on an isolated, air-gapped forensic workstation.
4. Run the decryption utility against the clone, never the original encrypted files.
5. Verify the file integrity of the decrypted data.
6. Scan the decrypted files with multiple next-generation EDR engines before moving them back to the newly rebuilt production environment.

8. Phase 4: Post-Incident Hardening & RDP Security

Surviving a MAIN attack is a grueling operational challenge. The response to the infection must serve as a catalyst for a comprehensive enterprise security overhaul, specifically targeting remote access vulnerabilities.

• Eradicate Public RDP Exposure: Remote Desktop Protocol (RDP) must never face the public internet. This is the primary entry point for the entire Dharma ransomware family. Access to the environment must require a VPN protected by strict multi-factor authentication (MFA), followed by a connection through a hardened jump-box or Privileged Access Management (PAM) solution.
• Implement Account Lockout Policies: Prevent the brute-force attacks that facilitate Dharma infections by enforcing strict account lockout thresholds (e.g., locking an account after 5 failed login attempts) within Active Directory.
• Implement Immutable Storage Vaults: A modern Veeam 3-2-1-1 backup structure is strictly mandatory. You must incorporate immutable repositories (such as Linux Hardened Repositories or AWS S3 with Object Lock). Immutable storage guarantees that once backup data is written, it cannot be modified, encrypted, or deleted—even if an attacker executes VSS deletion scripts.
• Deploy Endpoint Detection and Response (EDR): Deploy behavior-based EDR/XDR platforms configured to automatically isolate network adapters on hosts that attempt mass file modifications, execute suspicious commands, or exhibit credential dumping behaviors typical of manual ransomware intrusions.

The MAIN variant of the Dharma ransomware family represents a highly destructive, financially motivated threat that exploits fundamental perimeter security failures. Navigating this crisis requires a cool head, adherence to strict incident response frameworks, and a methodical approach to containment. Should this playbook highlight gaps in your current defensive posture, treat it as a mandate to immediately overhaul your enterprise IT infrastructure.