Exorcist

Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Modifies boot configuration data using bcdedit

Deletes System State backups

Uses wbadmin.exe to inhibit system recovery.

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.