Remove Nomad Ransomware

The Dharma Ransomware appears to be using a slightly reworked ransom message, or this is at least what seems to be the case in the latest variant of this threat – the Nomad Ransomware. This new file-locker is being spread on the Internet through software activators, game cracks, phishing emails, and other dubious content. The best way to prevent its attack and keep your files safe is to use a reputable antivirus application.

What Does the Nomad Ransomware Attack do?

Users who fall victim to this ransomware attack may immediately lose access to the majority of their files. This will happen because the Nomad Ransomware is designed to encrypt all kinds of popular file formats, rendering their contents inaccessible. All of these files will also have a unique suffix appended to their name. It uses the '.id-<VICTIM ID>.[nomad.crypt@onionmail.org].nomad' format – just like other Dharma variants.

The Nomad Ransomware also drops a ransom message titled 'info.txt.' Victims are likely to also see the ransom note in a new HTA window, which tells them the demands of the criminals. In this case, the attackers are keeping it short, and they do not reveal much apart from:

• They use the emails nomad.crypt@onionmail.org and crypt@msgsafe.io.
• They offer to sell a decryptor in exchange for Bitcoin. The criminals do not specify the exact sum they expect to receive.
• The hackers try to discourage users from exploring alternative data recovery options. They claim that this might damage their files even more. This is a bluff and you should not trust them.

Co-operating with the operators behind the Nomad Ransomware is out of the question. You have no reasons to trust them, and you will probably get scammed if you try to send Bitcoin to their wallet. Instead, use an antivirus tool to terminate the infection as soon as you can. Once you do this, you will prevent the threat from causing more damage. Next, you should start restoring files from a backup, or exploring other data recovery options.