Kiqu Ransomware Will Encrypt Victim Systems

In the course of analyzing malware samples, we came across a particular ransomware variant identified as Kiqu. This ransomware operates by encrypting files and modifying their filenames, adding the ".kiqu" extension. Moreover, Kiqu generates a text file named "_readme.txt," which serves as a ransom note.

To illustrate how Kiqu alters filenames, it renames files like "1.jpg" to "1.jpg.kiqu," "2.png" to "2.png.kiqu," and so on. Notably, Kiqu is associated with the Djvu ransomware family and is often distributed alongside other threats.

The ransom note issued by the attackers provides crucial instructions and includes two email addresses (support@freshmail.top and datarestorehelp@airmail.cc). Victims are urgently urged to make contact with the cybercriminals within a 72-hour timeframe to avoid an escalation of the ransom payment. Initially, the decryption tools are demanded at a rate of $490, but if victims fail to respond within the specified period, the ransom amount doubles, amounting to $980.

The ransom note emphasizes the necessity of obtaining the decryption software and a unique key from the attackers to restore the encrypted files. Additionally, an offer is made to decrypt a single file free of charge, with the caveat that the file should not contain any data of significant importance or value.

Kiqu Ransom Note Follows Djvu Pattern

The full text of the Kiqu ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-lOjoPPuBzw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Kiqu Get Inside Your System?

Ransomware like Kiqu can find its way into your system through various attack vectors. Understanding these entry points is crucial in implementing effective cybersecurity measures to protect your system. Here are some common ways ransomware like Kiqu can infiltrate your system:

• Phishing Emails: One of the most prevalent methods is through phishing emails. Attackers send deceptive emails that appear legitimate, containing malicious attachments or links. When users unknowingly open these attachments or click on the links, the ransomware is downloaded onto their system.
• Malicious Websites: Visiting compromised or malicious websites can lead to drive-by downloads, where the ransomware is automatically downloaded and executed on your system without your knowledge.
• Malvertising: Attackers may use malicious advertisements (malvertising) on legitimate websites to deliver ransomware to unsuspecting users. Clicking on these ads can trigger the download and installation of the ransomware.
• Exploiting Software Vulnerabilities: Ransomware can exploit security vulnerabilities in your operating system, software, or applications. It is crucial to keep your system and software updated with the latest patches to minimize these risks.
• Remote Desktop Protocol (RDP) Exploitation: If you have Remote Desktop Services enabled without proper security measures, attackers can exploit RDP vulnerabilities to gain unauthorized access to your system and deploy ransomware.
• Malicious Links on Social Media: Cybercriminals can use social media platforms to distribute links to malicious websites that host ransomware. Users may unknowingly click on these links, initiating the infection process.