Nood Ransomware is a Djvu Clone

While analyzing new malware samples, we discovered that Nood is a type of ransomware associated with the Djvu family. This malicious software encrypts files on the targeted system by appending the ".nood" extension to their filenames and generates a "_README.txt" file as a ransom note.

Nood ransomware employs a specific renaming pattern during the file encryption process, transforming "1.jpg" into "1.jpg.nood" and "2.png" into "2.png.nood," and so on. Given its connection to the Djvu family, there is a possibility that threat actors might use data-stealing tools like Vidar or RedLine to extract information before initiating the file encryption.

The ransom note informs victims that all their files, including pictures, databases, and documents, have undergone encryption using a robust algorithm and key. The sole option for recovering these files is to purchase a decryption tool and obtain a unique key.

The note offers a 50% discount and provides two email addresses (support@freshingmail.top and datarestorehelpyou@airmail.cc) for communication. It underscores the importance of responding within 72 hours to benefit from the reduced price for the decryption tools.

Nood Ransom Note Demands $999

The full text of the Nood ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted
with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
Do not ask assistants from youtube and recovery data sites for help in recovering your data.
They can use your free decryption quota and scam you.
Our contact is emails in this text document only.
You can get and look video overview decrypt tool:
hxxps://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a
Price of private key and decrypt software is $999.
Discount 50% available if you contact us first 72 hours, that's price for you is $499.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshingmail.top

Reserve e-mail address to contact us:
datarestorehelpyou@airmail.cc

Your personal ID:

How Can You Proactively Protect Your Data from Ransomware?

Protecting your data from ransomware requires a proactive and multi-faceted approach. Here are several strategies you can implement to enhance your defenses:

Regular Backups:
Frequently back up your important data to an external and secure location. Automated, regular backups ensure you have recent, clean copies of your files.

Offline Backups:
Keep some backups offline to prevent them from being affected in case of a ransomware attack. This could include external hard drives or air-gapped storage systems.

Update Software and Operating Systems:
Ensure that your operating system, software, and applications are regularly updated with the latest security patches. Many ransomware attacks exploit vulnerabilities in outdated software.

Use Antivirus and Antimalware Solutions:
Install reputable antivirus and antimalware software to detect and remove potential threats. Keep the software up-to-date to defend against the latest ransomware variants.

Network Segmentation:
Segment your network to limit lateral movement in case of a ransomware infection. This can help contain the impact and prevent the malware from spreading across the entire network.

Email Filtering:
Implement email filtering solutions to detect and block malicious attachments and links in emails. This helps prevent employees from inadvertently downloading ransomware.

By combining these measures, you can create a robust defense against ransomware and significantly reduce the risk of falling victim to such attacks. Regularly reassess and update your security measures to stay ahead of evolving threats.