NMO Ransomware Comes from the Dharma Family of Malware Threats Seeking Encryption of Files

The NMO Ransomware is another member of the Dharma Ransomware family. One of the most prolific and hurtful ransomware families, the Dharma Ransomware family's developers use various deceiving methods to deliver the threat to potential targets – pirated software, corrupted emails, manipulated advertisements, etc. Once the NMO Ransomware is executed on a vulnerable machine, it will start encrypting most of the users' files immediately. The NMO Ransomware targets numerous file extensions to cause as much dam as it can; the computer users' images, media, archives, documents, etc will become useless after being encrypted. To mark the damaged files, the NMO Ransomware will append the '.[dr.nemo@tutanota.com].NMO' extension to their names.

The NMO Ransomware's encryption is very strong and unbreakable. Therefore, infected users need to try to find another way to recover their data. However, contacting the attackers for help or paying the asked ransom is not an option since you cannot trust criminals in any circumstances.

The ransom note the NMO Ransomware displays for its victims can be found in a text file named 'info.text,' which contains instructions, the ransom amount, $500, and the email addresses to contact the attackers - dr.nemo@tutanota.com and mr.helper@gmx.com.

This ransom note displayed by the NMO ransomware reads:

'YOUR FILES ARE ENCRYPTED
ZAQ
Don’t worry, you can return all your files!
If you want to restore them, write to the mail: dr.nemo@tutanota.com YOUR ID
If you have not answered by mail within 12 hoNMO, write to us by another mail:mr.helper@gmx.com

ATTENTION!
We recommend you contact us directly to avoid overpaying agents

Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.'