2023 Ransomware Will Lock Your System
Our researchers came across the ransomware program dubbed simply "2023", when they were examining newly submitted file samples. This program's purpose is to encrypt data and demand payment for its decryption, and it belongs to the Dharma ransomware family.
On our test machine, this 2023 program encrypted files and made changes to their file names. The original names were extended with a unique ID, the email address of the cybercriminals, and a ".2023" extension. For example, a file originally labeled "1.jpg" was transformed into "1.jpg.id-9ECFA84E.[servicehelp@onionmail.org].2023."
Once the encryption process was completed, ransom notes were generated and displayed in a pop-up window, along with a text file named "README!.txt." In the text file, it's stated that the victim's data has been encrypted and stolen, and they are encouraged to get in touch with the attackers. The pop-up provides additional details about the ransomware infection, making it clear that this malware is primarily targeting businesses rather than individual users.
The victim is also notified that if they don't contact the attackers within 24 hours, the cybercriminals will start publishing and selling the stolen data on the darknet and hacker websites. To prevent data leaks and enable decryption, a ransom must be paid.
Before complying with the criminals' demands, the victim has the option to test the decryption process by sending an encrypted file. The note cautions against attempting manual decryption or using third-party recovery tools, as these actions may lead to data loss.
2023 Ransom Note Threatens Leaks
The full text of the 2023 ransom note reads as follows:
We downloaded to our servers and encrypted all your databases and personal information!
If you do not write to us within 24 hours, we will start publishing and selling your data on the darknet on hacker sites and offer the information to your competitors
email us: servicehelp@onionmail.org YOUR ID -
If you haven't heard back within 24 hours, write to this email:datahelp23@msgsafe.ioIMPORTANT INFORMATION!
Keep in mind that once your data appears on our leak site,it could be bought by your competitors at any second, so don't hesitate for a long time.The sooner you pay the ransom, the sooner your company will be safe..
Guarantee:If we don't provide you with a decryptor or delete your data after you pay,no one will pay us in the future. We value our reputation.
Guarantee key:To prove that the decryption key exists, we can test the file (not the database and backup) for free.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Don't go to recovery companies - they are essentially just middlemen.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) we're the only ones who have the decryption keys.
How Can You Protect Your Valuable Data from Ransomware?
Protecting your valuable data from ransomware is essential to prevent the loss of important files and avoid the financial burden of paying ransoms. Here are some effective measures to safeguard your data:
- Backup Regularly: Regularly back up your data to an external device or a secure cloud service. Ensure your backups are automated, frequent, and stored offline to prevent ransomware from encrypting them.
- Update Software: Keep your operating system, software, and antivirus programs up to date. Cybercriminals often exploit vulnerabilities in outdated software.
- Use Antivirus and Anti-Malware Software: Install reputable antivirus and anti-malware programs and keep them updated. These tools can help detect and prevent ransomware infections.
- Email Caution: Be cautious with email attachments and links. Do not open attachments or click on links in emails from unknown or suspicious sources. Verify the legitimacy of email messages before taking action.
- Download from Trusted Sources: Only download software, files, and media from reputable sources. Avoid torrent and file-sharing websites, as they often host malicious files.
- Enable Email Filtering: Use email filtering software to reduce the likelihood of phishing emails and malicious attachments reaching your inbox.
