Monthly Archives: November 2018

Matrix-THDA Ransomware is a threat that drops a text file claiming the user’s files were encrypted because of some server vulnerabilities. The cybercriminals not only claim they can provide the necessary decryption key and decryption software but also offer to help the victim to secure the server/system. However, we would not recommend trusting them as no matter how friendly and polite the ransom note may appear to be, in reality, there are no reassurances they will hold on to their end of the deal. Therefore, what we recommend to those who encounter the malware is deleting it. We believe it is safer to recover files from backup copies. Not to mention, using backup files would be cost-free as Matrix-THDA Ransomware’s creators may ask for a ransom. If you want to learn more before coming up with a decision you should read the rest of this report. For those who have already decided we would suggest completing the steps listed below the article. Read more »

One more ransomware infection - Yourhope@airmail.cc Ransomware - has been recently detected in the wild by specialists working at anti-spyware-101.com. They have immediately understood what it is capable of because research has clearly shown that this threat is a brand new variant of Scarab-Bomber Ransomware, a crypto-threat analyzed by specialists not long ago. Speaking more specifically, there is no doubt that this ransomware infection has been developed by cyber criminals to obtain money from users. One of the tactics used to push users into transferring money is locking their personal files. The ransomware infection tries to convince users that their files have been locked due to a security problem, but we can assure you that the main problem you have is the successful entrance of Yourhope@airmail.cc Ransomware. No worries; you will erase this threat yourself manually with our help. Sadly, we cannot promise that it will be very easy to unlock files encrypted by this threat. Paying money to cyber criminals is definitely not what we suggest that you do, but you need to know the truth – there might be no other ways to get files back. This is especially true if you have never backed up any of your files. Read more »

Cyber criminals have not stopped developing new ransomware infections on the HiddenTear engine yet because Scrabber Ransomware, a new HiddenTear-based ransomware infection, has been spotted in the wild by malware researchers. It seems that the ransomware infection targets both Russian and English-speaking users because it drops a ransom note in both languages after encrypting users’ personal files. At first glance, it acts as an ordinary ransomware infection; however, unlike ordinary computer threats, it seems that it does not demand money from users who fall victim to it. It only asks them to send a PC name and a user name (these are the same unless there is more than one PC user created). We cannot promise that your files will be unlocked once you do so even though the message dropped on victims’ computers claims that the ransomware infection has not been developed to obtain money from users: “We are not scammers and do not pursue the purpose of collecting money, do not file a complaint against us, please’ (taken from the English version of the ransom note dropped). Cyber criminals will not remove Scrabber Ransomware from the system for you either – you will have to do so yourself. No matter what you decide to do, i.e. whether or not you send the PC/user name to the ransomware developer, do not forget that you must fully remove this infection no matter what. Read more »

Epoblockl Ransomware is a computer infection that can encrypt user and system files. This seems to be one of the many random infections that have been terrorizing users lately. The ransomware program is not prominent enough to draw attention from the media, but it doesn’t mean it is any less dangerous than the notorious WannaCry Ransomware. The bottom line is that you must remove Epoblockl Ransomware from your computer immediately, and by doing so, you have to ensure that similar intruders to do not enter your PC again. Please bear in mind that some of the infection’s consequences might not be reverted. Read more »

Do you know what kind of malware might persist even if the infected operating system is reinstalled and the hard disk is replaced? It is UEFI (Unified Extensible Firmware Interface) rootkits. In the past, these rootkits were detected only in internal labs controlled by malware researchers, but LoJax has changed the history. It is the first UEFI rootkit to have been found in the wild. Intel created UEFI to replace BIOS (Basic Input/Output System), and all chipsets should use it by 2020. Unfortunately, that means that anyone could become the target of this malware. The rootkit was found to communicate with C&C servers that belong to Sednit, a well-known cyber-espionage group that is also known by other names, including Fancy Bear, PT28, Sofacy, and Strontium. This group has been active since 2004, and it is known for attacking government-level agencies and organizations. Read more »

Scarab-DD Ransomware shows a warning claiming the threat’s victims must contact the malicious program’s developers if they want to get their files back. As you see, the malware encrypts various data with a secure encryption algorithm, which is why once affected it cannot be opened without decryption tools. It is understandable some users might be thinking about complying with the hacker’s demands, but we do not believe it would be wise to do so. After writing to the cybercriminals, you could receive instructions on how to pay a ransom. Needless to say, there are no reassurances these people will hold on to their promises, which means you may lose your money in vain. Because of this we advise erasing the malware and restoring files from backup copies if you have any. To learn how to eliminate Scarab-DD Ransomware manually, you should take a look at the instructions placed below this report. As for more information on the threat's working manner or distribution, you should review the rest of the article. Read more »