Ransomware

Miia Ransomware is a malicious software that belongs to the Djvu family of ransomware. It is designed to encrypt files on the victim's computer, rendering them inaccessible and appending the extension .miia to each affected file. For example, a file named document.docx would be renamed to document.docx.miia after encryption. The encryption used by Miia Ransomware is highly sophisticated, typically involving AES-256 or RSA-2048 algorithms, making it virtually impossible to decrypt files without the unique decryption key held by the attackers. Once the files are encrypted, the ransomware generates a ransom note, _readme.txt, which is placed in every folder containing encrypted files. This note provides instructions for the victim on how to contact the cybercriminals and pay the ransom, usually demanding payment in Bitcoin.

Pgp (Makop) Ransomware, known for its damaging capabilities, is a member of the Makop ransomware family. This malware encrypts the victim's data and demands a ransom for decryption. Upon infecting a system, it appends files with a unique identifier, the criminal's email address, and the .pgp775 extension, making the original files unopenable without the correct decryption key. For instance, a file named photo.jpg would be modified to something like photo.jpg.[random-id].[datarestore@cyberfear.com].pgp775. The encryption process employed by Pgp (Makop) ransomware is sophisticated and typically uses either symmetric or asymmetric cryptographic algorithms, ensuring that unauthorized decryption is nearly impossible without the attacker's private key. Post-encryption, the ransomware generates a ransom note titled +README-WARNING+.txt, which it places in every folder containing encrypted files.

Mqpoa Ransomware is a type of malicious software that encrypts files on an infected system, making them inaccessible until a ransom is paid to the cybercriminals behind the attack. This form of ransomware employs advanced cryptographic algorithms to lock the victim's data, usually rendering decryption impossible without the corresponding decryption key, which only the attackers possess. Upon infection, the ransomware changes the original filenames to a random character string and appends a new extension, specifically .mqpoa. For instance, a file named document.jpg might be renamed to something like G6h3Jl.mqpoa. This obfuscation increases the panic among victims and leads them to consider paying the ransom to regain access to their files. Besides altering filenames, Mqpoa ransomware also creates a ransom note in multiple locations on the victim's system, commonly naming it #HowToRecover.txt.

ZAKI ESCOVINDA Ransomware is a malicious program belonging to the Chaos ransomware family, designed to encrypt files on a victim's computer and demand a ransom for their release. This ransomware appends a distinctive file extension to the affected files, changing their original names to include .escovinda. For instance, a file named photo.jpg would be renamed to photo.jpg.escovinda. Once the encryption process is complete, the ransomware leaves a ransom note, typically named read_it.txt, on the infected machine. This ransom note informs the victim that their files have been encrypted and instructs them to pay 70 USD in Bitcoin (BTC) for the decryption software. Notably, the note mentions an incorrect conversion of 0.1473766 BTC, a sum that has fluctuated significantly in value at the time of writing.

RedRose Ransomware is a notorious ransomware-type virus that infects systems by encrypting files and demanding a ransom for their decryption. Such malicious software operates by rendering critical data like documents, photos, and databases inaccessible. RedRose achieves this by appending a distinct file extension, .RedRose, to encrypted files. For instance, an original file named photo.jpg could be renamed to resemble 1234567890_.RedRose". The extension is usually accompanied by a random string of numbers, further complicating the identification and recovery of the original files. Upon completing the encryption, RedRose generates a ransom note, typically a {random}.txt file, where {random} is a random string of numbers. This ransom note is usually placed in every directory containing encrypted files, notifying the victim about the attack and the necessity to pay a ransom, usually in Bitcoin, to regain access to their data.

Crypto24 Ransomware is a particularly malicious type of software designed to encrypt files on a victim's computer and demand payment for their release. Once it infiltrates a system, it systematically encrypts personal data by appending the .crypto24 extension to filenames. For instance, a file named example.jpg would be transformed into example.jpg.crypto24, rendering it inaccessible. Following encryption, the ransomware generates a ransom note titled Decryption.txt. This file is usually placed in all affected directories and details the attack, informing victims that their data has been encrypted and providing instructions on how to pay the ransom. It warns against renaming or modifying the encrypted files, as doing so might render them permanently irrecoverable.

C*nt Ransomware, a variant of the notorious Dharma family, is a malicious program designed to encrypt files on infected systems and extort ransom from victims. It infiltrates devices through methods such as vulnerable RDP services, phishing emails, and malicious downloads. Once inside the system, it methodically works to encrypt files, changing their extensions to end with .c*nt, along with a unique victim ID and the attackers' email address. For example, a file formerly named 1.jpg could become 1.jpg.id-7GCNA64X.[d**kdriver777@cock.li].c*nt. The ransomware utilizes robust encryption algorithms typically found in Dharma ransomware variants, which can be a combination of symmetric and asymmetric cryptography, making unauthorized decryption virtually impossible without the specific decryption key held by the attackers.

Cipher (Proton) Ransomware is a notorious cyber threat that belongs to the Proton ransomware family, which primarily targets users by encrypting their valuable data and demanding ransom for decryption. Upon infection, this malware appends the .cipher extension to the filenames of encrypted files, marking them distinctly. For example, a file initially named document.jpg would be modified to document.jpg.[watchdogs20@tuta.io].cipher, highlighting the attacker's contact email. Using asymmetric encryption, Cipher (Proton) employs sophisticated cryptographic algorithms that render files unusable without a decryption key that only the attackers possess. Once encryption completes, the ransomware generates ransom notes in multiple forms: a full-screen message before the log-in screen, desktop wallpaper alterations, and text files named #Read-for-recovery.txt. These notes evade detailing the encryption process and solely urge victims to contact the cyber criminals via email for further instructions.