Overview Jokdach is a file-encrypting ransomware family that appends the .jokdach extension to user files and drops a ransom note named !!!READ_ME!!!.txt. Victims report that previously accessible documents and media become unreadable and are renamed (for example, 1.jpg → 1.jpg.jokdach). Related article: How to remove WhiteLock Ransomware and Restore Data? What Jokdach does to a…
Our WhiteLock Recovery: Rapid Triage, Expert-Engineered WhiteLock (family: Win32/Ransom.WhiteLock) is actively encrypting Windows environments and appending the .fbin extension. The threat actors drop a ransom note named c0ntact.txt, demand 4 BTC, and set a 4-day deadline. They claim data theft and direct victims to a Tor site where you authenticate with a client ID from…
Executive Summary LockBit 3.0 (aka LockBit Black) is a ransomware-as-a-service (RaaS) family widely used in targeted intrusions and double-extortion campaigns. The case you provided — files renamed with the .IfpmSWShs extension and a ransom note named IfpmSWShs.README.txt — is consistent with LockBit 3.0’s standard pattern of using a random 9-character extension and dropping a matching…
Overview BB is a crypto-ransomware strain in the MedusaLocker family that encrypts user data and appends the extension .BB to every affected file (for example photo.jpg → photo.jpg.BB). Victims find a ransom note file named Recovery_Instructions.html in every folder where files were encrypted. The ransom note lists Tor links and two contact emails (dec_helper@excic.com and…
GOTHAM ransomware — a concise snapshot GOTHAM is a GlobeImposter-family crypto-ransomware observed in malware uploads to VirusTotal. Its principal marker is that it encrypts files and appends a .GOTHAM extension. After encryption it writes a ransom HTML file (how_to_back_files.html) that instructs victims how to buy Bitcoin and contact the attackers. The actors offer to decrypt…
Our Miga Decryptor: Rapid Recovery, Expert-Engineered Our research team reverse-engineered parts of the Miga ransomware encryption logic and developed a secure decryptor that has restored data for multiple organizations worldwide. Compatible with Windows, Linux, and VMware ESXi, the decryptor emphasizes safety, reliability, and forensic accuracy. Related article: How to remove Proton/Shinra Ransomware (.OkoR991eGf.OhpWdBwm) and restore…
Advanced Recovery Tool for Proton/Shinra Our security team has engineered a decryptor specifically for Proton/Shinra ransomware. This tool was built after reverse-engineering the encryption routines used in variants like .OkoR991eGf.OhpWdBwm. It has been tested on Windows servers, VMware ESXi, and business environments, delivering consistent results for recovering files without corruption. Related article: How to Decrypt…
What 0xxx does to your data? 0xxx is a crypto-style ransomware that appends the extension .0xxx to files it encrypts (for example photo.jpg → photo.jpg.0xxx). In every compromised folder it drops a ransom note named !0XXX_DECRYPTION_README.TXT, explaining how to contact the attackers and demanding payment for decryption. Related article: How to Decrypt EncryptRansomware (C77L /…
Our C77L / X77C Decryptor: Rapid Recovery, Expert-Engineered Our research team has been tracking the C77L / X77C ransomware family, a sophisticated strain that leaves encrypted files with extensions such as .BAK, .[nullhex@2mail.co].8AA60918, .[mrdarkness@onionmail.org].40D5BF0A, .[ID-BAE12624][recovery-data09@protonmail.com].mz4, and .[ID-80587FD8][Dm_for_decrypt@protonmail.com].3yk. While no free public decryptor currently exists for modern versions of this ransomware, we have developed custom workflows…
C77L (aka X77C) is a Win64 ransomware family that appends attacker email + an 8-hex “Decryption ID”/volume serial to filenames (examples: .[nullhex@2mail.co].8AA60918, .[ID-80587FD8][Dm_for_decrypt@protonmail.com].3yk). It uses hybrid crypto (AES for file content + RSA to protect keys), drops ransom notes such as #Restore-My-Files.txt, and threatens to leak stolen data. Related article: How to remove BQTLOCK Ransomware…
