What is BuLock Ransomware?

BuLock Ransomware is a malicious program identified by computer security researchers. This malware is categorized as part of the MedusaLocker ransomware family, and its primary function is to encrypt files on the victim's system, adding a ".bulock16" extension to the original filenames.

BuLock Ransomware's Malicious Actions

Upon completion of the encryption process, BuLock generates a ransom-demanding message titled "HOW_TO_BACK_FILES.html." This message outlines that the victim's company network has been compromised, and the files within it have been encrypted using RSA and AES cryptographic algorithms. Additionally, the ransom note reveals that confidential or personal data has been exfiltrated from the network, employing a double extortion tactic. If the victim refuses to pay the ransom, the stolen content will be sold or leaked online.

The ransom note provides a testing option for the victim, allowing them to attempt decryption on 2-3 files before establishing contact with the attackers. Failure to do so within 72 hours results in an increase in the ransom amount. However, the note also warns that renaming or modifying the affected files, as well as using third-party recovery tools, will render the data undecryptable.

Resolving the Issues of BuLock Ransomware

While the ransomware demands payment, the experience with similar infections indicates that decryption is often impossible without the involvement of the cybercriminals. Paying the ransom not only fails to guarantee data recovery but also supports illegal activities. Therefore, we strongly advise against complying with ransom demands.

The recommended course of action is to remove BuLock ransomware from the infected system to prevent further file encryption. However, it is crucial to note that removal does not restore already affected data. The only reliable solution is to recover the files from a backup, provided one is available and ensure BuLock Ransomware is automatically removed using an anti-malware application.