Bhui Ransomware Expands Family of Djvu Clones

While examining malware samples, our expert team made an intriguing discovery - the emergence of Bhui ransomware, a member of the Djvu ransomware family. Once a computer is infected, Bhui takes control by encrypting files and adding the ".bhui" extension to their original filenames. For instance, a file named "1.jpg" would be transformed into "1.jpg.bhui," and "2.png" would become "2.png.bhui."

Apart from encrypting files, Bhui is designed to generate a ransom note known as "_readme.txt." This text file serves as a means to convey a critical message to the victims. The ransom note emphasizes that file decryption is exclusively possible with specialized decryption software and a unique key, which only the attackers possess. To begin the recovery process, victims are instructed to reach out to the attackers via the provided email addresses (support@freshmail.top or datarestorehelp@airmail.cc). By contacting them, the victims will receive detailed instructions on how to proceed with the data decryption.

Moreover, the ransom note presents two distinct amounts, namely $980 and $490, indicating that the decryption tools can be obtained at a discounted price if the victims initiate contact within a specified 72-hour timeframe.

Bhui Ransom Note Asks for Initial Payment of $490

The full text of the Bhui ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-vKvLYNOV9o
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Data from Ransomware Like Bhui?

Ensuring the safety of your data from ransomware attacks like Bhui requires implementing several protective measures. Here are some essential steps you can take to safeguard your data:

• Regularly Backup Your Data: Create frequent backups of all your important files and store them in a secure location. Consider using an external hard drive, a cloud storage service, or a combination of both. Make sure the backups are isolated from your primary system to prevent them from being affected by ransomware.
• Keep Your Software Updated: Maintain up-to-date software on your computer, including the operating system, antivirus programs, and other applications. Enable automatic updates whenever possible to ensure you have the latest security patches and bug fixes, which can help protect against known vulnerabilities.
• Exercise Caution with Email Attachments and Links: Be vigilant when opening email attachments or clicking on links, especially if they come from unknown or suspicious sources. Malicious attachments and links are common ransomware entry points. Verify the sender's authenticity and consider using anti-phishing tools to detect potentially harmful emails.
• Use Reliable Security Software: Install reputable antivirus and anti-malware software on your computer and keep it updated. These programs can detect and block ransomware threats, providing an additional layer of protection. Regularly scan your system for any signs of malware.
• Employ a Firewall: Enable a firewall on your computer to monitor incoming and outgoing network traffic. A firewall acts as a barrier between your system and potential threats, helping to prevent unauthorized access and the spread of ransomware.
• Disable Macros in Office Files: Ransomware often spreads through malicious macros embedded in Microsoft Office documents. Disable macros by default and only enable them if you trust the source and require their functionality.
• Enable Pop-up Blockers: Configure your web browser to block pop-ups, as they can be used to deliver ransomware or redirect you to malicious websites.

By implementing these preventive measures, you can significantly reduce the risk of falling victim to ransomware attacks like Bhui and protect your valuable data from encryption and extortion.