Ransomware campaigns have been active all year round. However, with the Christmas holidays almost here, malicious actors seem to be more active and determined. Security experts from FortiNet and Heimdal have reported that two of the most famous ransomware families…
A new ransomware type of trojan horse has been reported to affect an increasing number of online users, encrypting their files with the .rdm extension. Affected users report that renaming the files back to their original extension and removing the…
A new ransomware that has been reported to encrypt user data with the .him0m browser extension has been spotted to affect an increasing amount of users. The ransom note is in English and is very threatening and direct, giving users…
Yet another ransomware is infecting thousands of computers and encrypting users’ files. Researchers have dubbed it brcodesinfo@gmail(.)com because this email is used in the names of the encrypted files. The files get locked via the 256-bit AES algorithm and require…
Ransomware is restless, and so are the malicious actors behind it who are currently infecting millions of users. At the end of 2015, we are seeing new versions of encrypting families that have been active in the past. XRTN ransomware…
TeslaCrypt, also known as AlphaCrypt, Cryptesla, and Tescrypt is one of the most prevalent crypto viruses (or ransomware) at the moment, the other one being CryptoWall. Recently, we witnessed a freshly updated version of TeslaCrypt. This version was encrypting the…
Another variant of the Shade Trojan ransomware has appeared lately and bears the name Files1147@gmail(.)com. That is the email provided by cybercriminals, for where the ransom money to be sent. The ransomware encrypts files with a .breaking_bad file extension. In…
A new ransomware, or more likely, a new version of a well-known ransomware, is currently using an encryption algorithm even stronger than RSA-2048. The ransomware piece claims to have employed RSA-4096. Unfortunately, one of our own users has contacted us…
Recently, it has been reported that a Trojan that is also ransomware called Cryptesla 2.2.0 downloads itself through an Adobe Flash vulnerability. It is better known as TeslaCrypt and encrypts files in a .vvv file format. In its latest installment…
A new ransomware reported with the domain weekendwarrior55.com redirecting to mail.ru has been reported to encrypt user files with random extensions. Users have increasingly begun complaining that the malicious program has corrupted their data. However, unlike other ransomware, this particular…
If you haven’t heard – we’re in the midst of a ransomware tsunami. However, disasters often come in pairs. The vicious ransomware attacks are triggered by a strong current of fake tech-support scams. The double threat is currently sweeping away…
A new variant of the nefarious TeslaCrypt ransomware is circling the Web. This time, the malicious threat is encrypting files in a .vvv file format. Once it affects your system, it will create thousands of files inside multiple folders, along…
There is a copycat of the CryptoWall 3.0 Ransomware that is infecting computers. It is also known as PhonyWall. It searches for files with many different extensions, overwrites them with its own files and then displays the decryption note of…
A new version of CryptoWall arrived in the beginning of November. Some researchers immediately dubbed it CryptoWall 4.0, while others were more precautious and referred to it as to a ‘point release’. A couple of weeks later, all doubts evaporated.…
Cryptolocker.AB is a Ransomware Trojan horse of the Cryptolocker family. It searches for files with many different extensions, encrypts them with a “.crinf” extension, then asks for a huge ransom for decryption. It can delete Shadow Volume Copies, disable Windows…
Encryptor RaaS is a devastating trojan horse that causes quite the headaches. Symantec researchers have reported a new wave of encryptor RaaS hitting users on a global scale. This particular ransomware is detected to slip into the user system, modify…
Several ransomware variants have been known to decrypt more and more user files lately. The ransomware itself and is also known as DecryptorMax or CryptInfinite. This devastating cyber-threat to user PCs has proven that it can be quite effective by…
Our 3-part article series ends with a detailed description and analysis of TorrentLocker. Jump to the first part dedicated to CryptoWall, and the second part about CTB-Locker. TorrentLocker Ransomware Resume TorrentLocker is one of the biggest and most dangerous ransomware…
Power Worm is a Ransomware written in Windows PowerShell. It uses PowerShell for its payload. It encrypts a user’s files on a compromised computer and demands a ransom for decrypting them. Unfortunately, a newer variant of the Ransomware has a…
Traditionally, cryptography and its applications are defensive in nature, and provide privacy, authentication, and security to users (…) It can be used to mount extortion based attacks that cause loss of access to information, loss of confidentiality, and information leakage,…
