NOOSE Ransomware Named After Videogame Entity

NOOSE, a type of ransomware associated with the Chaos family, operates by infecting computers and encrypting files. The ransomware is named after the fictional law enforcement agency in the video game series Grant Theft Auto.

During the process of encryption, NOOSE adds the ".NOOSE" extension to the encrypted files, modifies the desktop wallpaper, and generates a ransom note named "OPEN_ME.txt." As an illustration, files like "1.jpg" become "1.jpg.NOOSE," and "2.png" transforms into "2.png.NOOSE."

The individuals behind this cyber threat demand payment in Monero (XMR) in exchange for the decryption software necessary to recover the victim's files. The ransom note provides a detailed set of instructions for the victim, including sending an email to a specified address with the unique ID and a screenshot of the payment transaction.

The perpetrators assure the victim that upon payment verification, the decryption software will be promptly dispatched. Additionally, the note contains crucial information, such as the possibility of a discount if the victim contacts them within 24 hours, a caution regarding potential delays in email responses, and a threat of permanent data loss if any attempt to manipulate transaction details is detected.

The wallapper image on the infected system is changed with a still shot of actor Javier Bardem from the movie "No Country for Old Men".

NOOSE Ransom Note Demands $1540 in Payment

The full text of the NOOSE ransom note reads as follows:

National Office of Security Enforcement [N.O.O.S.E] Report

Introduction:
National Office of Security Enforcement [N.O.O.S.E]
You were infected by a ransomware made by N.O.O.S.E
No need to Google us, we only exist when we want to.

What happened?
You are infected with the NOOSE ransomware. This version does have an antidot.
Your unique ID is: NOOSEVariant2ID3754865400

I want my data back:
To get your data back, you need our decryption software. Which only N.O.O.S.E have.
Our software is worth 1540 USD.

About the decryption software:
To decrypt your files and data you'll need a private key. Without it, you can't have anything back.
Our software uses your safely stored private key to decrypt your precious data.
No other softwares can decrypt your data without the private key.

Payment currency:
We only accept Monero XMR as a payment method.

Payment information:
Price: 9.7 XMR
Monero address: 476cVjnoiK2Ghv17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV5cYTKSd7CuF4LZJ76ZcDDt1WZZvpdZDuzbgPBPVs3yBBJ32

After the payment:
Send us a mail to malignant@tuta.io in the correct following format:
-Subject: [Your country name] Device/user name (Example: [USA] John Doe)
-My unique ID: [Your unique ID].
-Transaction ID: [Transaction ID] and an attached screenshot of the payment.

Verification and confirmation:
Once we verify and confirm your payment, we recognize your device and send you the decryption software.

Important notes:
-We might give you a discount if you contact us within 24 hours.
-Due to our busy emails, we may take up to 24 hours to respond.
-All of our clients got their data back after the payment.
-Failure to write in the correct form will get your mail ignored.
-Any attempt to fake a transaction ID or screenshot will lead to a permanent loss of data.

How Can You Protect Your Valuable Data from Ransomware?

Safeguarding your valuable data from ransomware involves implementing a combination of proactive measures and best practices. Here are several recommendations to help protect your data from ransomware attacks:

Regularly Back Up Your Data:
Ensure that you perform regular backups of your important files and data.
Store backups in a separate location, such as an external hard drive or a cloud service, to prevent them from being affected if your main system is compromised.

Use Reliable Security Software:
Install reputable antivirus and anti-malware software to detect and prevent ransomware infections.
Keep your security software up to date to ensure protection against the latest threats.

Keep Operating Systems and Software Updated:
Regularly update your operating system, antivirus software, and all other applications to patch vulnerabilities.
Enable automatic updates whenever possible to stay protected against known security flaws.

Exercise Caution with Email Attachments and Links:
Be wary of unexpected emails, especially those from unknown senders.
Avoid clicking on suspicious links or downloading attachments from emails that seem suspicious or unexpected.

Implement Network Security Measures:
Utilize firewalls and intrusion detection/prevention systems to monitor and control network traffic.
Restrict user permissions to only essential functions to minimize the potential impact of a ransomware attack.