Blaze Ransomware is a New Babuk Variant

Blaze Ransomware is a new file-locker variant that is being spread online with the use of fake email attachments. The criminals propagating this malware might use phishing messages to try and convince potential victims to download and run a malicious file. The payload may often be concealed as a document, image or archive. When the Blaze Ransomware runs for the first time, it will immediately get to work in the background. The malware needs just a few minutes to complete the attack, and encrypt the majority of the victim's files.

We consider Blaze Ransomware to be a part of the BabukLocker Ransomware family. After it encrypts and renames the files, it drops the ransom note 'How To Decrypt.txt.' It explains the attack to the victims and warns them that they will cause inevitable damage to their files if they try to use alternative data recovery methods. The advice of the criminals is to purchase a decryption service by messaging them at blazesupp@protonmail.com or by using the TOR-based Tox chat.

You can rest assured that trying to buy a decryption tool from anonymous cybercriminals is a terrible idea – do not accept this offer. Even if you meet their demands, they could easily scam you out of your money. Victims of the Blaze Ransomware should ignore the offer of the criminals, and use legitimate tools to try and fix the situation. The first step towards recovery is to run an up-to-date anti-virus tool, ensuring the malware's removal. After this, victims should explore alternative data recovery methods and options.