Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.
A ransomware cryptovirus called Ishtar is encrypting victims’ files over the past few days. The name is that of a Mesopotamian goddess of war and love, but the cybercriminals might have named their malware after the famous Israeli singer. Encrypted…
The Versiegelt seems to be a German variant of the Jigsaw ransomware cryptovirus. All encrypted files will have the extension .versiegelt appended to them. The virus does not seem to have any particular theme as past variants do. The ransom…
The Winnix Cryptor Team have developed a ransomware virus named after themselves – Winnix Cryptor. The cryptovirus will encrypt your files while appending the extension .wnx to each file. The ransom price that is asked for decryption is 4 Bitcoins,…
IFN643 is the name of a newly-found ransomware virus. This virus encrypts your files by placing the .ifn643 extension to them. After the encryption process is finished, it will put a file named “IFN643_Malware_Readme”. That file contains the ransom demand,…
Esmeralda ransomware is believed to be a new variant of the Apocalypse cryptovirus. The new strain uses the same domain for an e-mail contact and encrypts files by placing the same extension. That extension is .encrypted and is placed on…
MegaBackup.com is a website of a supposed backup platform. The website distributes lots of advertisements and can redirect you and affect your browsers and other applications, so it is considered adware. Pop-ups and banner ads are among the popular choices…
A new ransomware cryptovirus called Encryptile has appeared. All encrypted files will have the .EncrypTile extension appended to their names. The ransomware claims to use AES and RSA encryption algorithms. The ransom note gives a contact email with a Philippine-based…
Chinimplants.website is a domain page for an ad-pushing platform. The site generates bulks of advertisements and redirects on other websites. So, it is considered adware. Website owners make money from these adverts and also can extract information about you. To…
Searchoko.com is a search redirect and a domain for a browser hijacker. The logo of this hijacker is intentionally very similar to that of Google referring to its letters and their coloring. The hijacker will redirect you to the results…
Axzbryg.trade is a website hosting a tech support scam. The scam tries to scare you into calling the (877)-337-7936 phone number. It is said on the site that you need to contact Microsoft technicians on that helpline, but they are…
Popads.net is a website of an ad network that is also a big monetization platform. The website will distribute a bulk of advertisements and can redirect you to various websites, so it is considered as adware. Owners of such websites…
Pcmethodsteadfastcloud.online is a website that is related to a tech support scam and hosts it on its main page. The phone number +61-1800-737-431 is used for contacting the supposed support technicians. The scam tries to implement that your computer has…
A brand new strain of the Locky ransomware has been found overnight by malware researchers after the variant with the .shit extension had been discovered. The authors of the virus have decided to bring the Norse mythology theme back to…
Bart ransomware has been discovered in the wild by the malware researcher Jakub Kroustek from Avast. The new string of malware encrypts files with the .perl extension. Seems identical to Locky ransomware in its note and payment instructions page. To…
The latest iteration of Locky ransomware is here. Files are encrypted with a new extension – .shit, but it is possible for other extensions to appear as well. The cryptovirus now uses HTML files (.hta) and brings back the usage…
Lock93 is a newly-emerged ransomware cryptovirus. The ransom note which is displayed after the file encryption process is complete can be written either in Russian or English. All encrypted files will have the extension .lock93 appended to them. The origin…
Suppteam01@india.com is the name given to a cryptovirus that mimics the Cryptolocker ransomware. As it is not the first copycat and there are no other distinguishable characteristics for this virus except the email given as a contact detail, researchers named…
The Crypt888 ransomware cryptovirus is back and has a new variant called “Aviso”. The new variant targets users from Brazil, hence the ransom note is written in Portuguese. Aviso means “Warning” in Portuguese. The ransom note starts with that word…
InternetSpeedPilot.com is the web address for a browser hijacker named Internet Speed Pilot. The developers of the hijacker work for the company known as SaferBrowser. The company is famous for its browser hijacker applications. The undesirable software changes the new…
Cocoslim98 is a newly emerged cryptovirus, which is called like that, because of the email that it leaves for contacting the criminals behind it. Malware researchers say that its real name is “Rotor”. The virus will encrypt files on a…
