Ransomware

Sysdoz ransomware is a recently uncovered strain of file-encrypting malware identified during analysis of malicious submissions uploaded to VirusTotal. Like many modern ransomware families, Sysdoz is engineered to lock user data, disrupt operations, and pressure victims into contacting the threat actors for decryption. During the attack, it encrypts important files, attaches a lengthy victim-specific identifier…

Hit.wrx ransomware is a recently surfaced file-encrypting malware variant first reported by victims within the 360 Security community in late 2025. This threat is designed to lock personal and business files, append a “.wrx” extension to compromised data, and ultimately push victims into paying for decryption. Although only limited public documentation exists today, the behavior…

Black Shrantac ransomware is a highly advanced file-encrypting threat designed to compromise systems, lock user data, interfere with system visuals, and aggressively push victims toward ransom payments. Initially detected through suspicious file submissions uploaded to VirusTotal, this malware demonstrates the typical characteristics of financially motivated ransomware campaigns. After infiltrating a device, it encrypts files, renames…

Benzona ransomware is a newly observed encryption-based malware discovered during the examination of fresh file submissions on the VirusTotal platform. It is part of a broad class of ransomware strains that render a victim’s files inaccessible using strong cryptographic methods and then demand payment for decryption. After Benzona completes its encryption process, each affected file…

FckFBI ransomware is a malicious file-encrypting threat engineered to lock personal and professional data using strong encryption. Once active, it modifies all affected files by adding the .fckfbi extension and then leaves behind a ransom note instructing the victim on how to obtain a decryption tool—typically for a cryptocurrency payment. Much like other modern crypto-extortion…

ChickenKiller ransomware is a highly destructive file-encrypting threat designed to lock important data and append the .locked extension to every compromised file. It belongs to a modern family of extortion-based malware strains that silently infiltrate systems, corrupt files, and then pressure victims into making a payment for decryption. Once the ransomware finishes encrypting files, it…

If your NAS system has been attacked and your files now end in “.encrypt”, you’re likely facing the Filecoder ransomware — a Linux-targeting cryptovirus affecting storage platforms like Synology, QNAP, and other NAS devices. Our team has developed a specialized Filecoder NAS Decryptor. It works on ransomware variants that: We deliver safe, professional ransomware recovery…

A new ransomware strain identified as BLACK-HEOLAS has been confirmed through recent sample analysis on VirusTotal. Unlike traditional encryptors, this malware completely alters filenames into random alphanumeric strings before appending the extension “.hels”. For example, a file like resume.docx may become e1c2b5a7f0844b4c943ad13f3f44c941.hels. Once encryption completes, a ransom message titled hels.readme.txt appears in affected folders. The…

LockBit 3.0 Black is one of the most enduring and adaptable ransomware threats active in 2025. The variant identified by the “.AZrSRytw3” extension continues the group’s signature blend of speed, encryption precision, and psychological coercion.Files are renamed with random 9–10 alphanumeric extensions (e.g., report.xlsx.AZrSRytw3) and paired with ransom notes following the same naming scheme —…

A recent outbreak of C77L ransomware (also known as X77C) marks another step in the evolution of data-extortion campaigns. Emerging in November 2025, this strain appends a 10-character random string followed by the “.OXOfUbfa” extension to each encrypted file (e.g., photo.png.mV12nTsY3O.OXOfUbfa). The attackers behind this campaign claim to have stolen all victim data, promising to…