CY3 Ransomware Will Scramble Your Files
CY3 is a newly discovered ransomware strain that is part of the Dharma family of ransomware clones.
CY3 will behave like most other ransomware strains. It will encrypt most files on the target system, leaving them scrambled and unreadable. Encrypted file types include media files, archives, documents and databases.
Encrypted files will receive a long extension that consists of the victim ID string, the email used by the attacker and the ".CY3" string. This will turn a file named "image.jpg" into "image.jpg.id-STRING.[cybercrypt@tutanota.com].CY3".
Once the encryption process is complete, the CY3 ransomware will drop its ransom demands inside a plain text file named "info.txt". Similar text is also displayed inside a pop-up window. The longer version contained in the pop-up reads as follows:
All your files have been encrypted!
Don't worry, you can return all your files!
If you want to restore them, write to the mail: ronrivest@airmail.cc YOUR ID -
If you have not answered by mail within 12 hours, write to us by another mail:ronrivest@tuta.io
Free decryption as guarantee
Before paying you can send us up to 3 files for free decryption. The total size of files must be less than 3Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)
How to obtain Bitcoins
The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.
hxxps://localbitcoins.com/buy_bitcoins
Also you can find other places to buy Bitcoins and beginners guide here:
hxxp://www.coindesk.com/information/how-can-i-buy-bitcoins/
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
