Grounding Conductor Ransomware Demands Bitcoin

While examining malware samples uploaded to VirusTotal, our team came across a ransomware variant known as Grounding Conductor. Grounding Conductor's primary objective is to obstruct victims from accessing their files by compressing and encrypting them. Additionally, this ransomware inserts a ransom note named "readme.txt" into ZIP files.

Furthermore, Grounding Conductor alters file names. It retains the original file name and adds the victim's ID along with ".Grounding Conductor.zip" to the names. For example, it changes "1.jpg" to "1.jpg.{B9A9FF03-F898-813E-2B13-9DA770161220}.Grounding Conductor.zip," and "2.png" to "2.png.{B9A9FF03-F898-813E-2B13-9DA770161220}.Grounding Conductor.zip," and so on.

As mentioned earlier, a ransom note labeled "readme.txt" is found within every file that Grounding Conductor compresses. Victims can extract this note from all files compressed by Grounding Conductor. However, extracting other compressed files is not feasible, as attempting to do so results in a message indicating that the file is corrupted.

The ransom note adopts a demanding tone, outlining that the victim can decrypt their files but must adhere to specific instructions. It underscores the discouragement of contacting data recovery companies, as they may disrupt the process. The note includes a threat to sell or expose the victim's data if they do not contact the attackers within 12 hours.

Moreover, it implies that the attackers possess extensive knowledge about the victim and their organization, using this as leverage to convince the victim to pay the ransom. The note provides instructions for reaching out to the attackers via a messaging service and demands payment in Bitcoin.

Grounding Conductor Uses Custom Ransom Note

The full text of the ransom note displayed by the Grounding Conductor ransomware reads as follows:

CAN I DECRYPT MY FILES ?
YES.

SURE.

We guarantee that you can recover FULL of your data easily!. We are give you full instruction. And help you untill decryption process is totaly finished.

CONTACT US:

Download the (Session) messenger (hxxps://getsession.org) in messenger :ID"05bc5e20c9c6fbfd9a58bfa222cecd4bbf9b5cf4e1ecde84a0b8b3de23ce8e144e" You have to add this Id and we will complete our converstion.

You have to pay for decryption BITCOIN ONLY!

ATTENTION

IF YOU WILL CONTACT DATA RECOVER COMPANY THEY WILL WASTE YOUR TIME AND TRY TO GET MONEY FROM YOU, than they will try to contact us and try to got your money from 2 sides.
REMEMBER : IF SOMEONE PROMISE YOU DECRYPT !!! YOUR PERSONAL INFORMATION IS ONLY IN OUR HANDS !

REMEMBER !!!! This money will be from your pocket any way.

We can give you 1 - 2 encrypted files not big , NOT VALUE,for test (You send us encrypted we send you back decrypted data).

You data encrypted and only WE ARE have decryption key.(To decrypt your data you need just 1-3 hours, after payment to got your data back fully )

Do not rename encrypted files, do not try to decrypt your data by using third party software, it may permanent data loss.

We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part.

You have 12 hours to contact us.

Otherwise, your data will be sold or MADE PUBLIC!

IF YOU CONTACT DATA RECOVERY COMPANIES !!!! YOU MUST UNDESTAND YOU HAVE SO MUCH MORE CHANSE TO BE PUBLISHED ! ! !

We have a lot info about you and your clients , its can kill your organization ! DONT KILL YOU PESONAL AND BUSSINES.

PAY and NO ONE WILL BE KNOW ABOUT THAT situation .

How Can You Protect Your Data from Ransomware Attacks?

Protecting your data from ransomware attacks is crucial to prevent the loss of valuable information and avoid falling victim to cybercriminals. Here are some effective strategies to help safeguard your data:

Regularly Back Up Your Data:
Implement automated, scheduled backups of your data to an external device or a cloud-based service. Ensure your backup solution is not directly accessible from your main network to prevent ransomware from encrypting your backups.

Update Software and Operating Systems:
Keep your operating system, software, and antivirus programs up to date with the latest security patches and updates.

Use Strong Passwords and Multi-Factor Authentication (MFA):
Enforce the use of complex passwords and MFA for all accounts, especially those with access to sensitive data.

Implement Network Security Measures:
Employ a firewall and intrusion detection/prevention system to monitor and filter incoming and outgoing network traffic. Isolate critical systems from the rest of the network, limiting the potential for lateral movement by attackers.

Regularly Update and Patch Software:
Keep all software, including operating systems and applications, up to date with the latest security patches and updates.

Use Email Filtering and Anti-Malware Tools:
Deploy email filtering solutions to block suspicious attachments and links in emails. Use anti-malware and anti-ransomware software to detect and quarantine malicious files.