BIDON Ransomware Threatens Data Leaks

BIDON has emerged as a fresh variant of the notorious MONTI ransomware. Like other ransomware programs, it is specifically designed to encrypt files and extort payment in exchange for decrypting the data.

Upon executing a BIDON sample on our test system, the ransomware promptly initiated the file encryption process. Affected files had their filenames extended with a ".PUUUK" suffix. For instance, a file named "1.jpg" was transformed into "1.jpg.PUUUK," while "2.png" became "2.png.PUUUK," and so on.

Following the encryption procedure, BIDON generated a ransom note named "readme.txt." The contents of this note shed light on BIDON's utilization of double extortion tactics, primarily targeting large entities like companies instead of individual home users.

The ransom note serves as a notification to the victim that their data is now inaccessible due to encryption. It emphasizes that recovering the data without the involvement of the attackers is practically impossible.

The note strongly discourages the victim from attempting manual decryption or seeking assistance from third-party recovery tools, cautioning that such actions may irreversibly damage the encrypted files.

To compel the victim to cooperate, the note urges prompt communication with the cybercriminals. The attackers have extracted sensitive information during the infection, and if the victim hesitates to communicate or seeks help from recovery firms or law enforcement agencies, the stolen content will be publicly disclosed on the attackers' data-leaking website.

As a demonstration of their ability to decrypt data, the ransom note offers a free decryption test on two files. It further states that the criminals will only engage in communication with authorized personnel from the victim's company.

BIDON Uses Lengthy Ransom Note

The complete text of the BIDON ransom note reads as follows:

All of your files are currently encrypted by BIDON strain. If you don't know who we are - just "Google it."

As you already know, all of your data has been encrypted by our software.
It cannot be recovered by any means without contacting our team directly.

DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. However,
if you want to try - we recommend choosing the data of the lowest value.

DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond.
So it will be better for both sides if you contact us as soon as possible.

DON'T TRY TO CONTACT feds or any recovery companies.
We have our informants in these structures, so any of your complaints will be immediately directed to us.
So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately.

To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge.

You can contact our team directly for further instructions through our website :

TOR VERSION :

(you should download and install TOR browser first hxxps://torproject.org)

Also visit our blog (via Tor):

YOU SHOULD BE AWARE!
We will speak only with an authorized person. It can be the CEO, top management, etc.
In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company!
Inform your supervisors and stay calm!

How Can You Protect Your Sensitive Data from Ransomware Like BIDON?

Protecting your sensitive data from ransomware like BIDON requires a proactive and multi-layered approach. Here are some essential steps you can take to enhance your data security and safeguard against ransomware attacks:

• Regular Data Backups: Implement a robust backup strategy that includes regular and automated backups of your critical data to an offline or offsite location. This ensures that even if your primary data is compromised, you can restore it from backups without paying the ransom.
• Keep Software Updated: Ensure that all your operating systems, software, and applications are up-to-date with the latest security patches. Cybercriminals often exploit known vulnerabilities in outdated software to launch ransomware attacks.
• Use Antivirus and Security Software: Deploy reputable antivirus and anti-malware software on all your devices and keep it updated. These tools can help detect and prevent ransomware from infecting your systems.
• Enable Firewall and Network Security: Utilize firewalls and network security measures to control inbound and outbound traffic. A properly configured firewall can help block ransomware from entering your network.
• Restrict User Privileges: Limit user access to only what is necessary for their roles. This way, if a user account is compromised, the damage is contained to a specific area of your network.
• Use Email Filtering: Employ email filtering solutions to detect and block malicious attachments and links in emails, reducing the risk of ransomware infection through phishing attempts.