Nitz Ransomware Ramps Up Ransom Sum in Three Days

Upon analyzing malware samples, we discovered a new variant of the Djvu ransomware family known as Nitz. Its primary goal is to encrypt files on the affected device and modify their names by appending the ".nitz" extension. Nitz also creates a ransom note file named "_readme.txt." It is crucial to note that Nitz could be distributed alongside infostealing malware such as RedLine or Vidar. Nitz modifies filenames by renaming "1.jpg" to "1.jpg.nitz," "2.png" to "2.png.nitz," and so on.

The ransom note provided by Nitz gives payment and contact information and urges victims to contact the attackers within 72 hours to purchase decryption tools for $490, a discount from the original price of $980. The note emphasizes that encrypted files cannot be restored without these tools. Additionally, the note suggests that victims can send a single encrypted file to the attackers for free decryption. The attackers' contact email addresses in the "_readme.txt" file are support@freshmail.top and datarestorehelp@airmail.cc.

Nitz Ransom Note Asks for Initial Ransom of $490

The full text of the Nitz ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-v8HcfXTy5x
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Nitz Get on Your System?

Ransomware like Nitz can get on your system through various means, including phishing emails, malicious websites, software vulnerabilities, and fake software updates. Phishing emails may contain links or attachments that, when clicked or downloaded, can install ransomware on your device. Malicious websites may exploit browser vulnerabilities to download and install ransomware without the user's knowledge or consent.

Software vulnerabilities may be exploited by ransomware to gain access to a system and infect it. Finally, fake software updates may contain ransomware disguised as legitimate software updates, which, when installed, can infect the device with ransomware. To protect your system, it is crucial to keep your software up-to-date, avoid suspicious emails and links, and use reliable antivirus software.