Hgew Ransomware is a Djvu Variant

While examining new malware samples, we encountered a ransomware variant known as Hgew. This specific ransomware is crafted to encrypt files and modify their names by adding the ".hgew" extension. Additionally, Hgew generates a ransom message, which can be found in a file named "_readme.txt."

To illustrate how Hgew alters file names, it changes files like "1.jpg" to "1.jpg.hgew," "2.png" to "2.png.hgew," and so on. Hgew is part of the Djvu ransomware family, which suggests that cybercriminals may distribute it alongside information-stealing malware like RedLine or Vidar.

Within the ransom message, the culprits offer instructions and provide contact email addresses (support@freshmail.top and datarestorehelp@airmail.cc). They advise victims to reach out to them within a 72-hour window to avoid an increase in the ransom amount.

Initially, the decryption payment is set at $490, but failing to respond within the specified timeframe results in the ransom doubling to $980. Furthermore, the message emphasizes that there is no way to recover the encrypted files without obtaining both the decryption software and a unique key from the cybercriminals responsible for the attack.

Hgew Ransom Note Lists Two Contact Emails

The full text of the Hgew ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-iTbDHY13BX
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Safeguard YouR Data from Ransomware Attacks?

Safeguarding your data from ransomware attacks is crucial to protect your personal and professional information. Here are steps you can take to enhance your data security and minimize the risk of falling victim to ransomware:

Regularly Backup Your Data:
Maintain up-to-date backups of all important files on separate, offline, or cloud storage. Automate backup processes to ensure consistency.

Update and Patch Software:
Keep your operating system, software applications, and antivirus programs updated with the latest security patches. Enable automatic updates whenever possible.

Use Strong and Unique Passwords:
Create complex passwords and use a password manager to generate and store them securely. Enable multi-factor authentication (MFA) wherever available to add an extra layer of security.

Be Cautious with Email:
Avoid opening attachments or clicking on links in unsolicited emails, especially if they're from unknown senders. Verify the legitimacy of emails from sources you trust before taking any action.