Latest Ransomware news

CryptoWall 4 being distributed as a NSIS installer through Exploit Kits

CryptoWall 4.0 has been discovered being installed via the Nuclear Exploit kit. As an added twist, the malware payload is also being delivered as a NSIS installer that when executed installs the CryptoWall 4.0 ransomware.
- Lawrence Abrams
- November 25, 2015
- 05:06 PM
- 0
CryptInfinite or DecryptorMax Ransomware Decrypted

A new file-encrypting ransomware has been floating around this past week called CryptInfinite or DecryptorMax. At first this ransomware looked secure, but with further analysis by Fabian Wosar, it was discovered that a decrypter could be made that would recover your files for free.
- Lawrence Abrams
- November 20, 2015
- 04:21 PM
- 0
Chimera Ransomware uses a Peer-To-Peer Decryption Service

The Chimera Ransomware uses a new technique for distributing decryption keys through a peer-to-peer messaging application called Bitmessage. This method provides a very easy method of pushing decryption keys out to the victim while staying anonymous behind the peer-to-peer network.
- Lawrence Abrams
- November 17, 2015
- 01:56 PM
- 0
New TeslaCrypt version Released with Minimal Changes

A new variant of TeslaCrypt has been released that utilizes the same .CCC extension for encrypted files, but now uses the _how_recover_.HTML and _how_recover_.TXT filenames for the ransom notes.
- Lawrence Abrams
- November 17, 2015
- 10:04 AM
- 6
New Ransomware as a Service announced called Cryptolocker Service

A new Ransomware as a Service has been discovered called the Cryptolocker Service. This service states it will go live in the next few days and allow affiliates to distribute their ransomware for a 10% commission.
- Lawrence Abrams
- November 13, 2015
- 12:59 PM
- 0
Kaspersky Releases 14K Private Decryption Keys for CoinVault Victims

Kaspersky has released 14,000 additional decryption keys for users infected with the CoinVault or BitCryptor ransomware infections. Using their decryption tool you may be able to recover your encrypted files for free.
- Lawrence Abrams
- November 10, 2015
- 07:37 PM
- 3
Why Everyone Should disable VSSAdmin.exe Now!

Vssadmin.exe is a utility bundled with Windows that allows you to administer Shadow Volume Copies. Unfortunately, this tool is also being used by Ransomware developers to make it harder for you to recover your files. This article explains how Shadow Volume Copies work and why it is important for every user to disable vssadmin.exe.
- Lawrence Abrams
- November 06, 2015
- 02:55 PM
- 76
CryptoWall 4.0 released with new Features such as Encrypted File Names

A new version of CryptoWall has been released that displays a redesigned ransom note, new file names, and now encrypts a file's name along with the data as well. A new version of CryptoWall has been released that displays a redesigned ransom note, new file names, and now encrypts a file's name along with the data as well.
- Lawrence Abrams
- November 03, 2015
- 09:20 PM
- 19
New helpme@freespeechmail.org Ransomware can be Decrypted for Free

A new ransomware has started to become seen on various computer support forums that encrypts your data and then appends the helpme@freespeechmail.org string to the filename. Thankfully Kaspersky's RakhniDecryptor tool is able to decrypt this infection.
- Lawrence Abrams
- November 03, 2015
- 04:29 PM
- 39
Shoddy Programming causes new Ransomware to destroy your Data

It is bad enough when a ransomware infection encrypts your data and demands a ransom, but it's even worse when shoddy programming destroys it instead. This is what happened in a new variant of the Power Worm ransomware where bad programming encrypts your data using AES encryption and then throws away the key
- Lawrence Abrams
- October 30, 2015
- 02:55 PM
- 6
Latest TeslaCrypt Ransomware adds the .ccc extension to Encrypted FIles

A new version of TeslaCrypt has been released that is now using the ccc extension when encrypting files. This version utilizes the same payment site as previous variants and requires a 2 bitcoin, or approximately $500 USD, ransom in order to decrypt your files.
- Lawrence Abrams
- October 26, 2015
- 01:35 PM
- 2
Help recover files.txt Ransomware installed by targeted Remote Desktop or Terminal Services Attacks

A new file-encrypting ransomware has been discovered that appears to be installed via targeted Remote Desktop or Terminal Service attacks. This ransomware, which we call LowLevel4, encrypts your data with AES encryption and then demands 4 Bitcoins to get your files back.
- Lawrence Abrams
- October 20, 2015
- 05:42 PM
- 1
Is Microsoft adding TeslaCrypt Detections important to you?

Microsoft recently announced that they have updated their malicious removal tool to detect and remediate the TeslaCrypt ransomware infection due to the increased distribution and activity detected in August. This announcement just means that Microsoft has added further detection for this ransomware and will remove it via MSRT.
- Lawrence Abrams
- October 14, 2015
- 09:51 PM
- 3