What is Industrial Spy Market Ransomware?
Industrial Spy Mark Ransomware is the name given to a new strain of file-encrypting malware. There is no hard evidence that the new strain belongs to any of the big ransomware families.
Unlike the majority of popular ransomware types, Industrial Spy Market ransomware does not alter the names of files once it encrypts them. Both the name of the affected file and its extension remain intact, with no new extension added, making it virtually impossible to determine which files are encrypted unless you try opening them.
The ransomware threatens to steal data allegedly exfiltrated from the victim system and publish it on the dark web unless the victim pays up. Of course, victims can never be sure that they will receive a working decryption tool even if they do decide to play along and pay the ransom.
There is no fixed ransom demand in the note dropped by the ransomware. The file used for the note is named "readme.html" and is dropped on the desktop after encryption.
The full text of the ransom note goes as follows:
Greetings!
Unfortunately we have to report you that your company was compromised. All your files were encrypted and you can't restore them without our private key. Trying to restore it without our help may cause complete loss of your data.
Also we researched whole your corporate network and downloaded all your sensitive data to our servers. If we will not get any contact from you in 3 next days we will publish your data on the site "Industrial Spy Market"
You can find it there (hxxp://spyarea23ttlty6qav3ecmbclpqym3p32lksanoypvrqm6j5onstsjad.onion)
Tr Browser is needed (hxxps://www.torproject.org/download/)
Also we respect your work and time and we are open fr communication. In that case we are ready to discuss recovering your files and work. We can grant absolute privacy and compliance with agreements by our side. Also we can provide all necessary evidence to confirm performance of our products and statements.
Feel free to contact us with quTox (hxxps://tox.chat/download.html)
Our ToxID: [alphanumeric string]
Alternative method is email:inbox at supports24 dot net
Mark your messages - your personal ID:
