Niwm Ransomware is Another Generic Djvu Clone Targeting Files for Encryption

During the analysis of malware samples, our team of malware researchers identified Niwm, which is a type of ransomware belonging to the Djvu family. Ransomware is a type of malware that encrypts files, and Niwm is no exception. It appends the ".niwm" extension to the original filenames and drops a ransom note called "_readme.txt". For example, the ransomware will change "1.jpg" to "1.jpg.niwm" and "2.png" to "2.png.niwm". It is important to note that Djvu ransomware is often accompanied by information stealers like RedLine and Vidar.

Niwm's ransom note instructs victims to acquire decryption software and a unique key to recover their files. The attackers demand $490 as a fee, which can be reduced to $980 if the victim contacts them within 72 hours via the provided email addresses. Additionally, the ransom note includes an offer for victims to submit one encrypted file for a free decryption attempt before committing to the payment of the ransom or purchasing the decryption tools.

Niwm Ransom Note Uses Standard Djvu Template

The Niwm ransom note in full reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-v8HcfXTy5x
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Like Niwm Infect Your System?

Ransomware like Niwm can infect your system through a variety of means, including:

• Email attachments: Attackers may send phishing emails containing malicious attachments, such as Word documents or PDFs, which when opened, can execute the ransomware.
• Malicious links: Cybercriminals may send phishing emails or place ads with links to malicious websites, which can download and install the ransomware when clicked.
• Exploits: Attackers can exploit software vulnerabilities in operating systems, web browsers, or other applications to gain access to the system and install the ransomware.
• Drive-by downloads: Cybercriminals may infect legitimate websites with malware that downloads and installs the ransomware onto the system when the website is visited.
• Malicious software: Attackers may use Trojans, worms, or other types of malware to gain access to the system and install the ransomware.

To protect your system from ransomware like Niwm, it's important to keep your operating system and software up to date with the latest security patches, use anti-virus and anti-malware software, avoid clicking on suspicious links or opening unsolicited attachments, and regularly back up important data.