This week has been dominated by GlobeImposter releases that do not seem to stop. We also have a few CryptoMix variants and smaller ransomware variants. Otherwise, no big news released this week, which is always a good thing.
This week has mostly been about small variants being released, GlobeImposters all over the place, and some new CryptoMix variants. Of particular interest is a self-healing file system called ShieldFS that shows great promise in ransomware protection and some research from Google about how ransomware devs cash out their payments.
Really slow week, which is great. We did have some decryptors and updated decryptors released this week, which is always great. Of particular concern is the increase releasing of new CryptoMix variants. Thankfully, these variants do not seem to be netting to many victims at this time..
CryptoMix is releasing new variants very quickly now and is reminiscent of how the Locky developers used to distribute Locky.
A new variant of the CryptoMix Ransomware was released today that uses the Azer extension for encrypted files. This variant also ups its game by including 10 different public RSA encryption keys, compared to the single one that was used in the previous version.
It is always great to be able to announce a free decryptor for victim's who have had their files encrypted by a ransomware. This is the case today, where a decryptor for the Mole02 cryptomix variant was released.
Wow! What a brutal week. This week we have 37 ransomware stories, with 10 of them being on May 1st alone. Most of the new ransomware releases continue to be real crap, but together they add up to a wave of garbage that can do some serious harm.
A new variant of the CryptoMix ransomware was discovered that appends the email addresses firstname.lastname@example.org & email@example.com along with the .Wallet extension. This makes it the third ransomware using .wallet, with the first being Dharma and then Sanctions. Unfortunately, the reuse of an extension is only going to confuse victims.
A new ransomware called Mole was found by security researcher Brad Duncan while he was analyzing a new SPAM campaign. After examining this sample, I feel that this is probably another variant of the CryptoMix family as it has many similarities to the Revenge and CryptoShield variants.
Lots of news this week when it comes to ransomware. We have a Star Trek themed ransomware, new decryptors, lots of new crap ransomware, people modifying Petya for their own ends, and a new CryptoMix variant called Revenge. If your interested in ransomware, this week has a lot of news.