Ransomware

C77L, also tracked as X77C, is a ransomware family targeting 64-bit Windows systems. It modifies filenames by adding the attacker’s email address along with an eight-character hexadecimal “Decryption ID” (taken from the disk’s volume serial). Victims have reported encrypted files with endings like: This ransomware leverages a hybrid cryptographic approach, applying AES-256 in CBC mode…

The C77L / X77C ransomware family, sometimes appearing under the marker EncryptRansomware, is a formidable strain that locks files and renames them with extensions such as .BAK, .[[email protected]].8AA60918, .[[email protected]].40D5BF0A, .[ID-BAE12624][[email protected]].mz4, and .[ID-80587FD8][[email protected]].3yk. At present, no free universal decryptor has been released for its latest versions. However, our recovery framework combines AI-powered cryptanalysis, forensic study of…

GOTHAM is a ransomware threat that stems from the GlobeImposter family. This strain is crafted to encrypt a victim’s files and lock them behind the .GOTHAM extension. Once the encryption stage is completed, the malware leaves a ransom instruction file named how_to_back_files.html. Inside, victims are directed to purchase Bitcoin and contact the attackers for file…

After analyzing the cryptographic framework of the Miga ransomware family, our cybersecurity researchers developed a proprietary decryptor capable of restoring files across multiple infrastructures. Whether your systems run on Windows, Linux, or VMware ESXi, our decryptor is optimized for stability, accuracy, and dependable performance, ensuring that victims of this malware regain access to critical data…

Our cybersecurity division has developed a specialized decryption tool tailored for Proton/Shinra ransomware. This decryptor was created after in-depth reverse engineering of the encryption algorithms used by variants like .OkoR991eGf.OhpWdBwm. It has been extensively tested in enterprise environments, including Windows-based infrastructures and VMware ESXi, proving effective at restoring files without corruption or data loss. Affected…

0xxx is a strain of crypto-ransomware that locks user data and attaches the “.0xxx” extension to encrypted files. For instance, a file originally named photo.jpg becomes photo.jpg.0xxx. Alongside the encryption, the malware drops a ransom message named !0XXX_DECRYPTION_README.TXT inside every directory containing affected files. This document outlines the attacker’s contact details and the payment instructions…

BB ransomware is a variant of the MedusaLocker family, notorious for encrypting valuable data and locking systems until victims pay a ransom. Once active, it renames every encrypted file by appending the “.BB” extension (e.g., report.docx becomes report.docx.BB). Alongside file encryption, the malware generates a ransom note titled Recovery_Instructions.html, which appears in every folder affected….

The ransomware strain known as WhiteLock (classified as Win32/Ransom.WhiteLock) has been observed encrypting data on Windows systems. Once executed, it renames compromised files with the .fbin extension and leaves behind a ransom note named c0ntact.txt. Attackers demand 4 BTC to be paid within four days, claiming they have stolen sensitive data. Victims are instructed to…

Jokdach belongs to the category of ransomware, a strain of malware engineered to lock user files by encrypting them. Once active, it modifies documents, images, and other data by attaching the .jokdach extension and generates a ransom message called !!!READ_ME!!!.txt. Reports from affected users indicate that files that were previously accessible, such as photos or…

Sns ransomware is a recently uncovered threat that falls under the Makop/Phobos family of file-encrypting malware. Once deployed, it scrambles user files, attaches the .sns extension together with a unique victim ID and the attacker’s email, and drops a ransom demand in a file named +README-WARNING+.txt. Following the modern double-extortion trend, Sns does not merely…