Researchers discovered a new variant of the destructive STOP/DJVU ransomware called Moss ransomware corrupting data and extorting ransoms from its victims. Experts warn that the virus is very dangerous as it is operated by ruthless criminals who won’t hesitate to double-cross their victims.
Moss ransomware is designed to follow a classic ransomware infection pattern. It infects its host through trickery and corrupts the stored data with advanced cryptographic algorithms.
Upon successful infiltration, Moss will launch a scan that detects user-generated files such as databases, documents, spreadsheets, archives, and pictures. The ransomware will encrypt the detected files with an unbreakable cipher so that the user cannot access their data.
Victims can quickly recognize files encrypted by Moss because the ransomware renames the encrypted data by adding the “.moss” extension to them. For example, a file named “documents.zip” will be renamed to “documents.zip.moss.”
Table of Contents
Ransom Demands
Moss ransomware will create a text file “_readme.txt” in every folder containing encrypted files. The file is a short message that informs the victim that their files have been encrypted. Victims must purchase decryption software for $980.
Ransom note text:
“ ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-7596obcC8h
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
helpmanager@mail.ch
Reserve e-mail address to contact us:
restoremanager@airmail.cc
Your personal ID:---”
A 50% discount is offered to the victims who act quickly and contact the criminals within 72 hours after the encryption.
The ransom note instructs the victims to contact the hackers via email. Their messages should be addressed to either the helpmanager@mail.ch or restoremanager@airmail.cc email dresses. Victims can attach one encrypted file to their messages, which will be decrypted for free as proof that their data is recoverable.
Data Decryption
Unfortunately, as Moss is a relatively new ransomware, it hasn’t been fully analyzed and so third-party decryption is unavailable. However, experts advise against paying the criminals because such actions don’t guarantee results. Victims should not expect these criminals to keep their part of the deal as hackers are known to play dirty games,
Victims can use file backups stored on a cloud or external device to recover their data. Of course, the ransomware must be removed before data-recovery is attempted. Otherwise, the virus not only will re-encrypt the recovered files but could also infect the external device.
How Does Moss ransomware Infect Its Victims?
Despite hackers often deploying ransomware in brute-force attacks, Moss ransomware is not used in targeted attacks. Instead, the virus is spread through mass-distribution techniques, such as malspam, malicious links, fake updates, and pirated software. Trojans could also deliver this ransomware as a second stage malware.
Experts say that most cyber infections are preventable through good cyber hygiene. Therefore, users are recommended to follow the best security practices and keep their devices updated with the latest security patches.
Leave a Reply
Thank you for your response.
Please verify that you are not a robot.