What is the FilesEncrypted Ransomware?
Our researchers recently came across the FilesEncrypted ransomware - a member of the MedusaLocker family, which is capable of encrypting files on affected computers.
The infected files are appended with ".filesencrypted" extension and a ransom-demanding message named "how_to_back_files.html" appears on the desktop. The message states that the targeted company's network has been breached and important files have been encrypted.
To recover the compromised data, victims are required to purchase decryption tools from the attackers. If not contacted within 72 hours, the ransom will increase in size and if refused to pay, confidential/personal data might be sold or leaked. As such, before paying up, victims can test decryption on two to three files that do not contain valuable data. This is an indication that FilesEncrypted ransomware targets primarily companies rather than home users.
Therefore it is advised to take immediate action against this malicious form of software infection. Adopting preventive measures such as creating backups or using reliable antivirus programs can help prevent further damage caused by this ransomware strain. Furthermore, if an attack occurs, victims should not attempt to tamper with the encrypted files as it could lead to permanent loss of data.
Bear in mind that paying the ransom does not guarantee the decryption of affected files. Therefore, it is best to seek professional help from cybersecurity experts when dealing with ransomware. They can help investigate the attack and recover files without paying the ransom attackers. Ultimately, taking preventive measures is key in fighting against ransomware attacks.
Table of Contents
The FilesEncrypted ransom note
The full text of the ransom note produced by the FilesEncrypted ransomware reads as follows:
YOUR PERSONAL ID:
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.No software available on internet can help you. We are the only ones able to
solve your problem.We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..We only seek money and our goal is not to damage your reputation or prevent
your business from running.You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.Contact us for price and get decryption software.
Start a chat and follow the further instructions.
If you can not use the above link, use the email:
uncrypt-official@outlook.com
uncryptofficial@yahoo.comTo contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Why is it usually impossible to restore files encrypted by ransomware similar to the FilesEncrypted ransomware?
It is usually impossible to restore files encrypted by ransomware similar to the FilesEncrypted ransomware because of the strong encryption algorithms used. These algorithms are designed to make it extremely difficult, if not impossible, for anyone other than the attackers to decrypt the files.
The encryption keys used are also unique and generated randomly for each victim, making it virtually impossible to crack them without access to the attackers' servers. Furthermore, most ransomware programs delete or overwrite any existing backups of the affected files, making it even more difficult to recover them.
What is the best way to protect your valuable data from malware similar to the FilesEncrypted ransomware?
The best way to protect your valuable data from malware similar to the FilesEncrypted ransomware is to implement a comprehensive security strategy. This should include regularly backing up important files and storing them in an offline location, such as an external hard drive or cloud storage service. Additionally, it is important to keep all software and operating systems up-to-date with the latest security patches, as well as using strong passwords and two-factor authentication for any online accounts.
It is also recommended to use anti-malware software that can detect and block malicious programs before they can cause any damage. Finally, users should be aware of phishing emails and other social engineering tactics used by cyber criminals to gain access to their systems.
