VHD Ransomware Encrypts Files and Creates Backdoor for Malware

VHD ransomware is a recently discovered type of malware that restricts victims’ access to their data by encrypting their files and demanding a ransom payment for their recovery. The file-encrypting ransomware uses a powerful encryption algorithm to lock users’ data making it completely inaccessible. According to malware researchers, VHD ransomware is considered highly dangerous because it can allow other viruses and malware to infect a system. 

How is VHD Ransomware Distributed

Like many other ransomware infections, VHD ransomware is distributed via spam emails that contain malicious attachments, by exploiting vulnerabilities in the operating system and the installed software, or via malvertising.

The attackers send an email with fake header information, tricking victims into believing that it comes from the shipping company DHL or FedEx. The email informs them that the courier failed to deliver a parcel. Sometimes the spam emails pretend to be notifications of a shipment that victims have made. In any case, the only way to see what the email is referring to is to open the attached file or click on a link embedded inside the spam email. Accessing the malicious link or file will infect computers with the VHD Ransomware. 

Another way the ransomware is being distributed is by exploiting software installed on a targeted machine, or by operating system vulnerabilities. The most commonly exploited programs include the operating system itself, web browsers, Microsoft Office, and third-party applications. 

VHD ransomware can also be distributed via malvertising. Users should never click on suspicious adverts that they encounter when surfing the Internet and install an adblocker to prevent advertising in the future.

How Does VHD Ransomware Work

VHD ransomware attacks all versions of Windows including Windows 7, Windows 8.1 and Windows 10. Once installed onto the system, the ransomware starts scanning all the drives on the computer to search for files to encrypt. 

The data encrypted by VHD ransomware includes important documents, photos, videos and files such as .doc, .docx, .xls, .pdf, etc. The ransomware adds the “.vhd” extension to every compatible file it finds. Users will be unable to open files once they have been encrypted and had their extension changed. 

VHD ransomware then drops a HowToDecrypt.txt ransom note in each folder that contains encrypted files, as well as on the Windows desktop. The ransom note explains victims can decrypt his files if they make a bitcoin payment to their attacker.

VHD Ransomware Ransom Note:

Once the encryption process is completed, the ransomware will also erase all of the Shadow Volume Copies that are on the affected machine. Do so means the victim can’t use them to restore encrypted data. 

What to Do if Infected with VHD Ransomware

Removing malware threats by yourself might be very dangerous as you risk losing your important data for good. For that reason, you should look for expert advice or contact the following government fraud and scam websites to report for the ransomware attack:

• In the United States, go to the On Guard Online website.
• In Australia, go to the SCAMwatch website.
• In Canada, go to the Canadian Anti-Fraud Centre.
• In France, go to the Agence nationale de la sécurité des systèmes d’information
• In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.
• In New Zealand, go to the Consumer Affairs Scams website.
• In Ireland, go to the An Garda Síochána website.
• In the United Kingdom, go to the Action Fraud website.