Jywd Ransomware Doubles Ransom Demand in Three Days

Our team came across Jywd, a variant of the Djvu ransomware family, while examining ransomware samples. Jywd encrypts data and adds the ".jywd" extension to the filenames of the affected files. In addition, Jywd creates a ransom note in the form of a "_readme.txt" file. For instance, "1.jpg" would become "1.jpg.jywd" and "2.png" would become "2.png.jywd" after the ransomware encrypts the files. Jywd can also be distributed with other types of malware such as Vidar, RedLine, or information stealers.

The ransom note left by Jywd demands payment in exchange for the decryption software and a unique key to regain access to the encrypted files. If the victim contacts the attackers via email within 72 hours, they are offered a discount rate of $490. However, the price increases to $980 after that time. The ransom note provides two email addresses, support@freshmail.top and datarestorehelp@airmail.cc, for victims to use to reach the attackers. The ransom note also allows victims to send a single file to the attackers to have it decrypted, provided it does not contain any sensitive information, to prove their decryption capabilities.

Table of Contents

Jywd Ransom Note Threatens to Double Ransom in 72 Hours

The full text of the Jywd ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-fkW8qLaCVQ
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

What Measures Can You Take to Protect Your Files from Ransomware like Jywd?

There are several measures that can be taken to protect your files from ransomware like Jywd:

Backup your data regularly: Make sure to back up your important files regularly and store them on a separate device or in the cloud. This will ensure that you have a copy of your files even if they become encrypted by ransomware.
Keep your software up-to-date: Regularly update your operating system, antivirus software, and other programs to ensure that they are protected against known vulnerabilities that can be exploited by ransomware.
Be cautious of email attachments: Don't open email attachments or click on links from unknown or suspicious sources, as they may contain malicious code that can install ransomware on your system.
Use strong passwords: Use strong, unique passwords for your accounts, and avoid using the same password for multiple accounts. This will make it harder for attackers to gain access to your files through brute-force attacks.
Install anti-ransomware software: Consider installing anti-ransomware software that can detect and block ransomware attacks before they can encrypt your files.
Use a firewall: A firewall can block unauthorized access to your network and prevent malware from communicating with its command-and-control servers.

By taking these measures, you can reduce the risk of falling victim to ransomware like Jywd and protect your important files from encryption.