Cdaz Ransomware Encrypts Target Systems
In the course of evaluating new malware samples, it was discovered that Cdaz is a type of ransomware associated with the Djvu family. Cdaz encrypts files and alters their filenames by adding a specific extension (".cdaz"). For instance, it changes "1.jpg" to "1.jpg.cdaz," "2.png" to "2.png.cdaz," and so forth.
Furthermore, Cdaz generates a text file named "_readme.txt" as a ransom note, containing payment details and contact information. It's important to note that Djvu ransomware attacks often involve the use of information stealers like Vidar or RedLine. In such cases, cybercriminals aim to extract information before initiating the encryption process.
The ransom note asserts that a robust algorithm has been employed to encrypt various files, including pictures, databases, and documents, and their recovery is only possible through obtaining a decryption tool and a unique key. The attackers demand a payment of $980 for these tools, offering a 50% discount if the victim responds within 72 hours.
To showcase their decryption capability, they offer to decrypt one file for free, provided the file does not contain valuable information. Contact information is provided through two email addresses: support@freshingmail.top and datarestorehelpyou@airmail.cc.
Cdaz Ransom Note Demands $490
The complete text of the Cdaz ransom note reads as follows:
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-e21iz7dS58
Price of private key and decrypt software is $1999.
Discount 50% available if you contact us first 72 hours, that's price for you is $999.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:
support@freshingmail.topReserve e-mail address to contact us:
datarestorehelpyou@airmail.ccYour personal ID:
How Can Ransomware Like Cdaz Infect Your System?
Ransomware like Cdaz can infect your system through various vectors and techniques. Here are common ways in which ransomware may infiltrate a system:
Phishing Emails:
One of the most common methods is through phishing emails containing malicious attachments or links.
Users may be tricked into opening an infected attachment or clicking on a link that leads to the download and execution of the ransomware.
Malicious Websites:
Visiting compromised or malicious websites can expose your system to drive-by downloads.
Exploiting vulnerabilities in browsers or plugins, attackers can silently download and install ransomware on your device without your knowledge.
Malvertising:
Malicious advertisements (malvertising) on legitimate websites may lead users to websites that host ransomware.
Clicking on these ads can trigger the download and execution of the ransomware payload.
Exploiting Software Vulnerabilities:
Ransomware can take advantage of unpatched software vulnerabilities to infiltrate a system.
Keeping your operating system and software updated with the latest security patches is crucial to prevent exploitation of known vulnerabilities.
Removable Media:
Ransomware can spread through infected USB drives, external hard drives, or other removable media.
Connecting an infected device to a computer can lead to the ransomware spreading to that system.
Malicious Downloads:
Downloading software or files from untrustworthy sources, such as peer-to-peer networks or unofficial websites, can expose your system to ransomware.
Always download software from official and reputable sources.
