Ransomware

Crystal Rans0m Ransomware represents a serious threat to computer users due to its dual capability of encrypting files and stealing information. This ransomware, written in the Rust programming language, stands out because it does not append any specific extension to the encrypted files, which can make it harder for victims to identify the infection. During the encryption process, the malware uses sophisticated algorithms, rendering files unusable without the corresponding decryption key. Upon encryption, a pop-up message appears on the victim's screen, containing a ransom note that demands a payment of $50 in Monero (XMR) cryptocurrency. The note also provides a countdown timer to pressure the victim and instructs them to contact the attackers via the Session messaging app using a specified Session ID.

Secdojo Ransomware is a sophisticated type of malware designed to encrypt files on an infected system, rendering them inaccessible until a ransom is paid. Typically deployed through malicious email attachments, illicit downloads, or software vulnerabilities, this ransomware appends a unique file extension, .secdojo, to all the encrypted files. For instance, a file named document.txt would be renamed to document.txt.secdojo, indicating that the file is under the control of the attackers. The ransomware employs strong encryption algorithms, commonly using AES (Advanced Encryption Standard) and RSA (Rivest–Shamir–Adleman) to lock files, making decryption without the attackers' key virtually impossible. Compounding the problem, Secdojo Ransomware generates a ransom note file named index.html in each affected directory. This note typically warns victims that their files are encrypted and gives instructions on how to pay the ransom, which is usually demanded in Bitcoin.

RDP (Chaos) Ransomware is a malicious program that belongs to the Chaos ransomware family. It is designed to encrypt data on infected computers and subsequently extort victims for payment in exchange for the decryption key. Once launched on a computer, the ransomware scans for files and, upon locating them, encrypts these files and appends a new extension, .encrypted, to their filenames, making the original files inaccessible. For instance, a file named document.docx will be renamed to document.docx.encrypted. After the successful encryption of files, the ransomware alters the victim’s desktop wallpaper and drops a ransom note titled read_it.txt. This note informs the victim that their files have been encrypted and provides instructions on how to restore the affected data, typically demanding payment in cryptocurrency such as Bitcoin, Litecoin, Ethereum, or Solana.

Tyson Ransomware is a form of malicious software that falls into the category of ransomware. Once it infects a computer, it encrypts the user's files, making them inaccessible without a specific decryption key. This ransomware appends its unique extension .tyson to the encrypted files, indicating they have been compromised. For example, a file named document.docx would be renamed to document.docx.tyson. The encryption algorithm used by Tyson Ransomware is typically robust, often employing advanced cryptographic techniques that make decryption nearly impossible without the attackers' original key. This encryption further complicates the victim's ability to use their files, as the ransomware encrypts various types of files including documents, images, and databases. Once files are encrypted, Tyson Ransomware generates a ransom note titled DECRYPTION INSTRUCTIONS.txt and places it in various locations on the compromised system, such as the desktop.

Discovered during a routine examination of malware submissions to VirusTotal, Foxtrot Ransomware is a nefarious variant from the MedusaLocker family. This ransomware encrypts files and appends the extension .foxtrot70 to the filenames, making previously accessible files inaccessible without the decryption key. Upon encryption, it generates a ransom note named How_to_back_files.html, which is placed in all affected directories. The note claims that files have been encrypted using a combination of RSA and AES cryptographic algorithms, a blend designed to thwart any decryption attempts without the attacker's specific key. Victims are warned against using any third-party recovery software, as this would allegedly lead to permanent data corruption. Additionally, the note ominously states that confidential and personal data has been exfiltrated and will be released publicly unless the ransom is paid within 72 hours. To instill a semblance of trust, the attackers offer to decrypt a few non-sensitive files for free.

Miia Ransomware is a malicious software that belongs to the Djvu family of ransomware. It is designed to encrypt files on the victim's computer, rendering them inaccessible and appending the extension .miia to each affected file. For example, a file named document.docx would be renamed to document.docx.miia after encryption. The encryption used by Miia Ransomware is highly sophisticated, typically involving AES-256 or RSA-2048 algorithms, making it virtually impossible to decrypt files without the unique decryption key held by the attackers. Once the files are encrypted, the ransomware generates a ransom note, _readme.txt, which is placed in every folder containing encrypted files. This note provides instructions for the victim on how to contact the cybercriminals and pay the ransom, usually demanding payment in Bitcoin.

Pgp (Makop) Ransomware, known for its damaging capabilities, is a member of the Makop ransomware family. This malware encrypts the victim's data and demands a ransom for decryption. Upon infecting a system, it appends files with a unique identifier, the criminal's email address, and the .pgp775 extension, making the original files unopenable without the correct decryption key. For instance, a file named photo.jpg would be modified to something like photo.jpg.[random-id].[datarestore@cyberfear.com].pgp775. The encryption process employed by Pgp (Makop) ransomware is sophisticated and typically uses either symmetric or asymmetric cryptographic algorithms, ensuring that unauthorized decryption is nearly impossible without the attacker's private key. Post-encryption, the ransomware generates a ransom note titled +README-WARNING+.txt, which it places in every folder containing encrypted files.

Mqpoa Ransomware is a type of malicious software that encrypts files on an infected system, making them inaccessible until a ransom is paid to the cybercriminals behind the attack. This form of ransomware employs advanced cryptographic algorithms to lock the victim's data, usually rendering decryption impossible without the corresponding decryption key, which only the attackers possess. Upon infection, the ransomware changes the original filenames to a random character string and appends a new extension, specifically .mqpoa. For instance, a file named document.jpg might be renamed to something like G6h3Jl.mqpoa. This obfuscation increases the panic among victims and leads them to consider paying the ransom to regain access to their files. Besides altering filenames, Mqpoa ransomware also creates a ransom note in multiple locations on the victim's system, commonly naming it #HowToRecover.txt.