MIRROR Ransomware Encrypts Files

We have identified MIRROR as a ransomware variant associated with the Dharma family. MIRROR is designed to encrypt files and alter their filenames, while also displaying two ransom notes in the form of a pop-up window and the creation of an "info-MIRROR.txt" file.

The MIRROR ransomware appends the victim's ID, tpyrcedrorrim@tuta.io email address, and ".Mr" extension to filenames. For example, it changes "1.jpg" to "1.jpg.id-9ECFA84E.[tpyrcedrorrim@tuta.io].Mr," "2.png" to "2.png.id-9ECFA84E.[tpyrcedrorrim@tuta.io].Mr," and so on.

The ransom note informs the victim about the encryption of all their files and suggests a potential solution for file restoration by instructing them to contact a specified email address (tpyrcedrorrim@tuta.io) with a unique identifier. An alternative contact email (mirrorrorrim@cock.li) is also provided.

Moreover, the note advises against using intermediaries for communication, highlighting potential risks such as overcharging, unjustified debit, and transaction rejection. The attackers claim to offer encrypted data recovery services with guarantees, including a recovery demo for up to three files as evidence of their capabilities.

Furthermore, the victim is cautioned against renaming encrypted files and urged not to attempt decryption using third-party software to prevent permanent data loss or falling prey to scams.

MIRROR Ransom Note in Full

The complete text of the MIRROR ransom note reads as follows:

MIRROR
All your files have been encrypted!
Don't worry, you can return all your files!
If you want to restore them, write to the mail: tpyrcedrorrim@tuta.io YOUR ID 9ECFA84E
If you have not answered by mail within 12 hours, write to us by another mail:mirrorrorrim@cock.li
We strongly recommend that you do not use the services of intermediaries and first check the prices and conditions directly with us.The use of intermediaries may involve risks such as:
-Overcharging: Intermediaries may charge inflated prices, resulting in improper additional costs to you.
-Unjustified debit: There is a risk that your money may be stolen by intermediaries for personal use and they may claim that we did it.
-Rejection of the transaction and termination of communication: Intermediaries may refuse to cooperate for personal reasons, which may result in termination of communication and make it difficult to resolve issues.
We understand that data loss can be a critical issue, and we are proud to provide you with encrypted data recovery services. We strive to provide you with the highest level of confidence in our abilities and offer the following guarantees:
---Recovery demo: We provide the ability to decrypt up to three files up to 5 MB in size on a demo basis.
Please note that these files should not contain important and critical data.
Demo recovery is intended to demonstrate our skills and capabilities.
---Guaranteed Quality: We promise that when we undertake your data recovery, we will work with the utmost professionalism and attention to detail to ensure the best possible results.
We use advanced technology and techniques to maximize the likelihood of a successful recovery.
---Transparent communication: Our team is always available to answer your questions and provide you with up-to-date information about the data recovery process.
We appreciate your participation and feedback.
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

How Can Ransomware Infect Your Computer?

Ransomware can infect a computer through various methods, often exploiting vulnerabilities or relying on social engineering tactics. Here are common ways ransomware can infiltrate a computer:

Phishing Emails: Attackers often use phishing emails to distribute ransomware. These emails may contain malicious attachments or links. Opening an infected attachment or clicking on a malicious link can trigger the ransomware installation process.

Malicious Websites: Visiting compromised or malicious websites can expose your computer to ransomware. Drive-by downloads occur when malware is automatically downloaded and installed on a user's device without their knowledge or consent.

Malvertising: Cybercriminals can inject malicious code into online advertisements. Clicking on these ads may lead to the download and installation of ransomware on the victim's computer.

Exploit Kits: Cyber attackers may use exploit kits to target vulnerabilities in software or operating systems. If your system is not updated with the latest security patches, these kits can take advantage of vulnerabilities and deliver ransomware.

Removable Storage Devices: Ransomware can spread through infected USB drives or other removable storage devices. If an infected device is connected to a computer, the malware may transfer onto the system.

Social Engineering: Attackers may use social engineering techniques to trick users into installing ransomware. This can include deceptive pop-up messages, fake software updates, or fraudulent notifications that convince users to download and execute malicious files.

Drive-by Downloads: Visiting compromised or malicious websites can result in unintentional downloads of ransomware. Exploiting vulnerabilities in browsers or plugins, attackers can initiate automatic downloads without the user's knowledge.

To protect against ransomware, it's crucial to regularly update software, use reputable security software, exercise caution when opening emails or clicking on links, and maintain secure backup practices to recover data if an infection occurs. Additionally, staying informed about the latest cybersecurity threats and best practices is essential in preventing ransomware attacks.