Nifr Ransomware Will Lock All Your Files

If you find that you are unable to access your files, including documents and images, and they have a ".nifr" extension, it means that your computer has been attacked by a variant of the STOP/DJVU ransomware.

This malicious software encrypts all the personal data on your computer and adds the ".nifr" extension to them. Then, a message will appear on your desktop with instructions on how to make a payment in Bitcoin to decrypt your data. These instructions are contained in a file named "_readme.txt". The NIFR ransomware targets files such as .doc, .docx, .xls, .pdf, as well as images and videos.

When the NIFR ransomware infects your computer, it scans your files for the targeted formats and encrypts them, making them inaccessible. The affected files will have their extensions changed to ".nifr".

After the encryption process is complete, the ransom note contained in the "_readme.txt" file is displayed on your desktop. The note will contain instructions on how to contact the ransomware authors, usually via the email addresses support@fishmail.top and datarestorehelp@airmail.cc. The victims are then requested to make a payment in Bitcoin to obtain the decryption tools.

Nifr Ransomware Asks for Nearly $1000 in Ransom After Three Days

The complete text of the Nifr ransom note reads as follows:

ATTENTION!

Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-oTIha7SI4s
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
support@fishmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

How is Ransomware Like Nifr Commonly Distributed?

Ransomware like Nifr is commonly distributed through various methods, including phishing emails, malicious websites, software vulnerabilities, and fake software updates. Phishing emails are one of the most common methods used by cybercriminals to distribute ransomware. These emails often contain malicious attachments or links that, when clicked, will infect the victim's computer with the ransomware.

Malicious websites are another common way to distribute ransomware like Nifr. Cybercriminals create fake websites that look like legitimate ones to trick users into downloading malicious software. Ransomware can also be spread through software vulnerabilities, which are security flaws in software that hackers can exploit to install malware on victims' computers.

Lastly, ransomware can be disguised as software updates or downloads. Cybercriminals may create fake software updates that contain ransomware, and when users download and install the update, their computer becomes infected with the ransomware. It's important to always download software updates from trusted sources and be cautious when downloading software from the internet.