Krize Ransomware Will Encrypt Your System

Our team discovered a new ransomware strain known as Krize while analyzing file samples. Krize operates by encrypting files and appending the ".krize" extension to their names. Additionally, it alters the desktop wallpaper and creates a file titled "leia_me.txt," which contains a ransom note.

To illustrate how Krize alters filenames during encryption, it renames files like "1.jpg" to "1.jpg.krize" and "2.png" to "2.png.krize," and so on. The ransom note is composed in Portuguese and serves as a notification to victims that their files and data have been taken and encrypted. The note emphasizes that decryption and data recovery are unfeasible without the decryption key held by the attackers.

To engage with the cybercriminals, victims are instructed to reach out via email (globalkrize@proton.me or krize@onionmail.com) or use the provided Richochet chat ID. The ransom note also issues a warning that failure to cooperate within 72 hours will lead to data destruction.

Krize Ransom Note Written in Portuguese

The full text of the Krize ransom note reads as follows:

Todos os arquivos e dados do seu dispositivo foram roubados e criptografados por KRIZE!

Aviso: é impossível descriptografar e recuperar seus dados após terem sido sequestrados por nosso Ransomware.

A única forma de recuperar seus dados, é através da nossa chave de descriptografia.
Para adquiri-la, entre em contato através de um dos canais abaixo:

Contato via e-mail: globalkrize@proton.me
ou
Fale conosco em TEMPO REAL pelo Richochet CHAT:
Baixe o Richocet: hxxps://www.ricochetrefresh.net
Nosso ID: ricochet:2xsddstwqapvn6vyyoeo3pbfcubrphu3udasvmsralazvbsssvvlhryd

Entre em contato conosco em até 72 horas para evitar a destruição completa de seus dados e o fim da sua privacidade.

Coopere conosco e evite que seus dados sejam destruídos de forma irreversível.
Aviso: Tentar recuperar de forma autônoma ou deletar qualquer arquivo, acabará prejudicando o processo de descriptografia.
Aviso: Não cooperar conosco irá resultar em mais ataques direcionados a você, além da exposição de todos os seus arquivos particulares.
Aviso: O envolvimento de qualquer autoridade judicial resultará na exposição de todos os seus arquivos na internet.

Informe seu ID de atendimento em nosso chat: -

Assunto gerais: krize@onionmail.com

KRIZE E. GROUP

Você faz parte da trama, e não da tragédia do viver.

How Can Ransomware Like Krize Infect Your System?

Ransomware like Krize can infect your system through various methods, commonly involving social engineering techniques and security vulnerabilities. Here are some common ways ransomware can infect your system:

• Phishing Emails: One of the most prevalent methods is through phishing emails. Cybercriminals send deceptive emails with malicious attachments or links that, when clicked, download and execute the ransomware on your system.
• Malicious Links: Ransomware can also be distributed through malicious links on websites, social media platforms, or instant messaging services. Clicking on these links can lead to the download and execution of the ransomware.
• Exploit Kits: Cybercriminals use exploit kits, which are tools that target known vulnerabilities in software or operating systems. If your system is not up-to-date with security patches, the ransomware can exploit these vulnerabilities to gain access and infect your system.
• Malvertising: Attackers can use malvertising, which involves placing malicious ads on legitimate websites. If you click on such an ad, it can redirect you to a website that downloads the ransomware onto your computer.
• Fake Software or Updates: Cybercriminals may create fake software or updates that claim to improve security or offer some useful functionality. However, when users download and install these fake programs, they inadvertently install the ransomware.
• Infected USB Drives: Ransomware can spread through infected USB drives or other removable media if you connect them to your system without proper security measures.
• Remote Desktop Protocol (RDP) Attacks: If RDP is enabled without adequate security measures, attackers can use brute force attacks to gain access to your system and deploy the ransomware.
• Watering Hole Attacks: In this method, attackers compromise a legitimate website that is frequently visited by the target audience. When users visit the site, they unknowingly download the ransomware.