Kostya is the name of a Czech ransomware cryptovirus. The ransom message that it displays is written in the Czech language and has a skull with the name “Kostya” shown on top. The virus claims in this ransom note that…
RESTORE-FILES!_{ID}_.txt – this is what users who have been affected by Comrade Circle ransomware see after their files have been encrypted with an added .comrade file extension to them. The Comrade Circle virus does not waste any time In explaining…
A ransomware using the .raid10, .blt, .globe, .encrypted, .mia.kokers@aol.com file extensions and believed to be a variant of JigSaw crypto viruses has been reported to cause new infections in a second, updated version. The updated version of globe uses the…
Researchers at Proofpoint have previously identified a ransomware virus, known as Hades Locker. The virus mimics the notorious Locky ransomware’s ransom note; however, researchers are still not convinced whether or not this is Locky. The researchers believe that the HadesLocker…
Another Fsociety themed ransomware virus is on the loose. The name is based on that of the hacker ring in the popular TV show “Mr. Robot” and is written in a semi-leet format – Fs0ci3ty. This cryptovirus will encrypt your…
HadesLocker is the name of a recently found ransomware cryptovirus which gives you a week to pay one Bitcoin. If you do not meet this criterion the price for decryption will be two Bitcoins. The malware researcher Michael Gillespie reported…
A lot has happened since we released the previous part with ransomware decryption instructions. Many viruses which were initially thought to be impenetrable have been decoded and brought new hope for those who do not want to pay money to…
A ransomware cryptovirus called KillerLocker was recently discovered in the wild. The ransom note it shows is written in Portuguese and gives 48 hours for victims to contact the cybercriminals. The virus states in its ransom message that it uses…
JokeFromMars, also known as MarsJoke ransomware uses AES cipher to encrypt files, adding the .a19 and .ap19 file extension to them. The ransomware virus demands 0.7 or 1.1 BTC (depending on it’s variant) payment to cyber-criminals. The good news is…
A new ransomware virus spreads through the Remote Desktop Protocol (RDP) found on many computer systems. Its real name is Xpan, but many victims and some researchers refer to it as TeamXRat ransomware. The name TeamXRat comes from the cybercriminals…
Ransomware infection, calling itself CryptoLockerEU 2016 uses the “.send 0.3 BTC crypt” file extension which it adds to files it encrypts on infected computers. This is the first case we’ve seen where the ransom money demanded are included in the…
This is an instructive article to help you remove Cerber README.hta Ransomware and restore encrypted files. Cerber ransomware virus has appeared out into the wild in a new variant using a README.hta file, according to malware researcher Michael Gillespie. What…
This article is created to help remove Globe Ransomware v1, v2 and v3 .WormKiller@india.com.xtbl and .[pingy@india.com] and decrypt files. Two very devastating ransomware variants of the famous JigSaw ransomware which was released as a service online have been successfully decrypted.…
Nuke ransomware virus is here and it aims to nuke any chance it’s victims have of seeing their files again, by encrypting them with a strong AES-256 bit cipher. The ransomware demands from affected users to contact the criminals at…
Ransomware virus that has been specifically designed to attack systems running OS’s for servers, like the Windows Server 2012 has been detected to cause infections and encrypt files on compromised server. ESG malware researchers have reported that this may be…
New version of the Razy ransomware virus, known by the name Krypte has been released and has begun encrypting files with what appears to be an AES cipher. The virus has been created exclusively for German users. The virus aims…
Princess Locker virus has recently been discovered by the malware researcher Michael Gillespie. The virus looks very much alike the Alma Locker ransomware. The methods of infection are still unknown, but since this could be a variant of Alma, the…
Locky ransomware continues to evolve. The new extension .ODIN is placed as an appendix to the original file extension names after they get encrypted. The cryptovirus seeks to encrypt nearly 400 different file types. As the ransom note states, data…
Virlock ransomware has apparently been updated and is now capable of propagating itself via the cloud. Hence, the ransomware can be spread negligently from one infected to another, eventually file-locking an entire network. This update seen in the code of…
New variant of the Samas ransomware has been reported to demand the sum of 1.7 bitcoins after it uses RSA encryption to encipher files of infected computers, adding the .iloveworld file extension to them. The ransomware then drops a PLEASE_READ_FOR_DECRYPT_FILES_{number}.html…
