Ransomware

Mimic, also tracked under the name Pay2Key, has emerged as a dangerous ransomware family that encrypts data with the .Encrypt3 file extension. Businesses and government networks have been severely impacted, losing access to essential databases and executables. In response, our security team has created a dedicated .Encrypt3 decryptor designed to restore files without negotiating with…

Bruk ransomware is a malicious encryption-based malware strain designed to block access to critical files and demand ransom payments in exchange for decryption. Our research team has carefully reverse-engineered its encryption process and developed a secure decryptor capable of restoring files without paying criminals. Optimized for Windows environments and enterprise workloads, our solution ensures stability,…

Our incident response specialists have thoroughly reverse-engineered the cryptographic logic behind SolutionWeHave ransomware. By carefully analyzing its encryption algorithms and studying live attack samples, we built a tailored decryptor capable of restoring data for affected organizations across multiple environments. The tool has been tested on Windows servers, Linux distributions, and VMware ESXi systems, ensuring precise…

DarkNetRuss is a new and dangerous strain of ransomware that belongs to the CyberVolk family. Once it compromises a device, it encrypts documents, databases, and personal files using strong algorithms. The infected data is renamed with the .DarkRuss_CyberVolk extension, making it impossible to access without the attackers’ key. Victims also receive a ransom note called…

LockSprut is a recently identified ransomware family that encrypts victim data and assigns the .rupy3xz1 extension to locked files. Alongside encryption, it places a ransom instruction file named LOCKSPRUT_README.TXT within affected directories. Each victim is given a unique personal identifier, which attackers demand to be shared via anonymous messaging platforms such as Tox and Session….

A newly detected strain of the Proton/Shinra ransomware family, identified as Shinra v3, has surfaced and is actively targeting victims worldwide. This version encrypts user data and tags the files with a random extension, such as .gwlGZaKg, making it difficult for affected users to immediately recognize the infection. Consistent with prior activity from this group,…

The LolKek ransomware strain is a file-encrypting malware that alters file extensions to .R2U. Once it infiltrates a system, it locks up personal and corporate files—spanning documents, media, and databases—before dropping a ransom instruction file named ReadMe.txt. Victims are directed toward a TOR-hosted payment portal or an alternate URL like https://yip.su/2QstD5 for communication. As with…

Krypt ransomware, also recognized under the aliases Proton and Shinra, is one of the most destructive malware families currently targeting enterprises. Known for its rapid encryption speed, advanced hybrid cryptography, and double-extortion model, Krypt has paralyzed organizations worldwide across sectors like finance, education, manufacturing, and healthcare. To address this growing threat, our research team has…

KillBack is a strain of ransomware designed to encrypt a victim’s files and alter their extensions by adding a unique identifier followed by .killback. Once encryption is complete, the malware leaves behind a ransom message named README.TXT, demanding that victims pay in Bitcoin within 24 hours. The note warns against third-party recovery tools and stresses…

A newly discovered ransomware family, identified as LockFile .enc ransomware (Huarong 500.exe), has surfaced in recent weeks. Reports describe incomplete encryption attempts, ransom notes named with randomized characters, and extortion demands of $5,000 payable in Bitcoin. Upon analysis, researchers determined that this malware was crafted in Python, bundled with PyInstaller, and employs AES-256-GCM for encryption….