Kamikizu Ransomware Spotted in the Wild

Security researchers recently spotted a new strain of ransomware that belongs to the ZEPPELIN family of ransomware clones. ZEPPELIN, in turn, has its origins in the earlier Buran ransomware.

Kamikizu will encrypt almost every file on the system it infects. Once deployed,  the ransomware begins encrypting all its targeted extensions. Affected files include almost every document, archive, media and database file type.

Once files get encrypted, they receive a multi-part new extension appended after the original one, containing the string ".kizu" and the victim's alphanumeric ID string. This would make a file previously called "document.txt" transform into "document.txt.kizu.[alphanumeric ID string].

The ransom note is deposited inside a plain text file named "!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT". The full text of the note goes as follows:

Kamikizu Ransomware.

## YOUR DATA HAS BEEN STOLEN AND ENCRYPTED ##

You are not able to decrypt it by yourself!

The only method of recovering your data is to purchase our unique decryptor.

Only we can give you this and only we can recover your files.

## IF YOU DO NOT RESPOND ON TIME, ALL STOLEN DATA WILL BE PUBLISHED ON OUR TOR SITE ##

To be sure we have the decryptor and it works you can send an email: kamikizu@onionmail.org and decrypt one file for free.

But this file should be of not valuable!

Do you want to restore your files and keep them private?

Write to email: kamikizu at onionmail dot org

Reserved email: kamikizu at keemail dot me

Your personal ID: -

## IMPORTANT ##

 * Do not rename encrypted files.

 * Do not try to decrypt your data using third party software, it may cause permanent data loss.

 * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.