How Dangerous is the Kings Ransomware?

Dealing with file-encryption Trojans is incredibly difficult. Victims are often unable to restore any of their files, because these threats make sure ot encrypt important data, and disable as many recovery options as possible. For example, the Kings Ransomware was discovered only recently, but it has already infected dozens of systems worldwide. The goal of this malware is to prevent users from accessing their important documents, media, and other files. It uses the '.kings' extension to mark the names of all locked files.

We have identified the Kings Ransomware to be a part of the very dangerous Babuk family of file-encryption Trojans. Sadly, this means that this malware is impossible to decrypt for free – its victims will need to resort to alternative, unreliable data recovery options. Currently, the only surefire way to restore files that the Kings Ransomware has locked is to recover their original copies from an offline backup.

The Kings Ransomware drops the ransom note 'RestoreFiles.txt' on infected computers. Just like other ransomware creators, the ones behind this campaign are asking for money. They claim to be selling a working decryption service, which users can pay for in Bitcoin. The exact price is not specified and, instead, the criminals ask victims to message them at decryptydata@gmx.de or decryptydata2@gmx.net for details. Trying to co-operate with ransomware operators is, of course, a terrible idea. They may try to take your money without giving anything in return. You should not risk your funds by sending them to anonymous cybercriminals. Instead, work on removing the infection with the assistance of antivirus software. After you finish removing the Kings Ransomware, try out alternative data recovery tools and advice available online.