69 Ransomware Uses Brief Ransom Note

There is a new strain of file-encrypting malware in the wild. The new ransomware is called simply the 69 ransomware and it has a ransom demand note that is as short and concise as its name.

When the 69 ransomware is executed on a targeted system, it will encrypt the vast majority of files on it. The encryption process will affect most media file types, archives, databases and documents. The encrypted files receive the ".69" extension, which gets appended past their original one. In this way, a file that was previously named "document.doc" will turn into "document.doc.69".

Encrypted files are scrambled and their contents are unreadable and inaccessible, which makes the ransomware a significant threat when it comes to data loss. The 69 ransomware drops its unusually brief ransom note inside a plain text file named "Readme_now.txt". The note mentions no amount for the ransom and contains just a contact email that victims can use to get in touch with the ransomware operator. Of course, negotiations with cyber criminals are never advisable.

The full text of the ransom note is as follows:

Your personal files have been encrypted, send an email to demon386@onion.com to recover them. Your ID: [alphanumeric string]