Cdwe Ransomware Locks Most Files

Cdwe was identified during the analysis of new malware samples. It has been determined that Cdwe belongs to the Djvu ransomware family. This variant encrypts files and modifies their filenames by adding the ".cdwe" extension. For example, a file originally named "1.jpg" is changed to "1.jpg.cdwe," and "2.png" becomes "2.png.cdwe."

In addition to file encryption, Cdwe creates a ransom note in the form of a "_readme.txt" file. Due to its association with the Djvu family, there is a potential that threat actors employ data stealers like Vidar or RedLine to extract information before initiating file encryption with Cdwe. The victim is informed that all their files, including pictures, databases, and documents, have been encrypted using a strong algorithm and a unique key. The only way to recover the files is by obtaining a decryption tool and a specific key.

The message introduces a time-sensitive discount and provides two email addresses (support@freshingmail.top and datarestorehelpyou@airmail.cc) for communication. It underscores the importance of responding within 72 hours, emphasizing that data restoration is impossible without making the necessary payment.

Cdwe Ransom Note Follows Established Djvu Pattern

The full text of the Cdwe ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-e21iz7dS58
Price of private key and decrypt software is $1999.
Discount 50% available if you contact us first 72 hours, that's price for you is $999.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshingmail.top

Reserve e-mail address to contact us:
datarestorehelpyou@airmail.cc

Your personal ID:

What Can You to Do Minimize the Risk of Malware Attacks?

To minimize the risk of malware attacks, consider implementing the following practices:

Use Reliable Security Software:
Install reputable antivirus and anti-malware software on your devices.
Keep the security software up to date to ensure it can detect the latest threats.

Keep Software Updated:
Regularly update your operating system, software, and applications.
Enable automatic updates when possible to ensure timely patching of vulnerabilities.

Exercise Caution with Email:
Be wary of email attachments and links, especially from unknown or unexpected sources.
Avoid clicking on suspicious emails or links, and verify the legitimacy of emails before interacting with them.

Secure Your Network:
Use strong, unique passwords for your Wi-Fi network and change them regularly.
Enable network firewalls and consider using a virtual private network (VPN) for added security.

Backup Regularly:
Regularly back up your important data to an external device or a secure cloud service.
In the event of a malware attack, having recent backups can help you recover lost data.

Use a Firewall:
Enable and configure firewalls on your devices and network to monitor and control incoming and outgoing traffic.