Intel Ransomware Threatens Double Extortion

During the examination of newly submitted file samples, our team came across the Intel ransomware, a malicious program affiliated with the Dharma ransomware family. This harmful software encrypts data and demands payment for the decryption process.

On our experimental system, files encrypted by Intel were not only encoded but also given a new naming convention. The original file names were extended with a unique ID specific to the victim, ".[intellent@ai_download_file]," and the ".intel" extension. For instance, a file originally named "1.jpg" was transformed into "1.jpg.id-9ECFA84E.[intellent@ai_download_file].intel."

Once the encryption was completed, ransom notes appeared in a pop-up window and as text files titled "README!.txt." These files were deposited into each encrypted folder and on the desktop. The pop-up message indicates that this ransomware specifically targets companies and employs double extortion tactics.

The content of the text file informs the victim that their data has been encrypted and stolen, urging them to contact the attackers via email. The pop-up contains additional details about the ransomware infection, reiterating the claims of encryption and data theft. It also issues a warning that failure to contact the cyber criminals within 24 hours or refusal to pay the ransom will result in the leaked content being exposed on the dark web or sold to the victim's company competitors.

As a demonstration that recovery is feasible, the message offers a complimentary decryption test for a single file. The victim is cautioned against using third-party decryption tools, as they may render the affected data irretrievable. Seeking assistance from recovery companies is also discouraged, as their fees would add to the financial loss incurred by the victim.

Intel Ransomware Note in Full

The complete text of the Intel ransom note reads as follows:

intellent.ai We downloaded to our servers and encrypted all your databases and personal information!

If you do not write to us within 24 hours, we will start publishing and selling your data on the darknet on hacker sites and offer the information to your competitors
email us: intellent.ai@onionmail.org YOUR ID -
If you haven't heard back within 24 hours, write to this email:intellent.ai@onionmail.org

IMPORTANT INFORMATION!
Keep in mind that once your data appears on our leak site,it could be bought by your competitors at any second, so don't hesitate for a long time.The sooner you pay the ransom, the sooner your company will be safe..
we've looked at all of your reports and your company's revenue.
Guarantee:If we don't provide you with a decryptor or delete your data after you pay,no one will pay us in the future. We value our reputation.
Guarantee key:To prove that the decryption key exists, we can test the file (not the database and backup) for free.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Don't go to recovery companies - they are essentially just middlemen.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) we're the only ones who have the decryption keys.

How Can You Protect Your Sensitive Files from Ransomware Attacks?

Protecting your sensitive files from ransomware attacks is crucial to safeguarding your data and maintaining the security of your digital assets. Here are some effective measures you can take:

Regular Backups:
Frequently back up your important files to an external hard drive or a secure cloud service. Ensure that backups are automated and stored offline to prevent them from being affected by ransomware.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software on your computer. Keep it updated to ensure protection against the latest threats, and perform regular scans of your system.

Update Software and Operating Systems:
Regularly update your operating system, software applications, and security software. Software updates often include patches for vulnerabilities that could be exploited by ransomware.

Exercise Caution with Email Attachments and Links:
Be cautious when opening email attachments or clicking on links, especially if the email is unexpected or comes from an unknown sender. Ransomware often spreads through phishing emails.

Use Strong, Unique Passwords:
Create strong, unique passwords for your accounts. Consider using a password manager to generate and store complex passwords securely.