Nordteam Ransomware
Nordteam ransomware is a new ransomware variant that belongs to the wider family of Spora ransomware clones.
The ransomware encrypts most media, document, database and archive file types, rendering the majority of data on the target system inaccessible.
Once encryption completes, files are renamed, appending a string of four random alphanumeric characters serving as an additional extension. To this effect, a file previously named "horse.jpg" will turn into something like "horse.jpg.ogpn".
The ransom note is dropped inside a plain-text file called "[victim ID string] ReadMe.txt".
The full text of the ransom note is as follows:
Your Data Is Locked And Important Data Downloaded xls,PDF Files, Documents,Invoices .. .
For Decrypting Files You Should Buy Our Decryption Program And We Will Send You Decryption Tools And Remove Your Important Files From Servers.
If No Payment Is Made We Will Publish Your Important Data Or Sell/Send Them To Your Competitors And If Don't Want To Pay Your Decryption Key Will Be Deleted From The Servers.
* WARNING: * No One Else Can Help You ,Don't Waste Your Business Time , Anyone/Any Company Offering Help Will Get Extra Fee Added To Us Or Simply Will Scam You.
Your Personal ID:
-
Our Email Address: Nordteam at mail dot ee
If You Don't Receive A Response Within 24 Hours From The First Email Please Email Us At : Nordtalk at tutanota dot com
If You Don't Contact Us Within 48 Hours Decryption Price Will Doubles ,This Is Just Business To Get Benefits .
The Price Depends On How Faster You Contact Us , Send Personal ID And Check Mail Spam .
What Is Our Guarantee ?
You Can Send Some Files For Decryption Test, We Will Decrypt Them And Send To You.
---------------------------------------
Attention!
Do Not Modify,Rename Infected Files.
Using Third-Party , Recovery Softwares May Corrupt Your Data Forever.
---------------------------------------
Buy Bitcoin :
Coindesk Link :
hxxps://www.coindesk.com/learn/how-can-i-buy-bitcoin/
LocalBitcoins Link And You Can Get More Info At Google :
hxxps://localbitcoins.com/guides/how-to-buy-bitcoins
There is no known decryption tool to deal with the Nordteam ransomware, making offline backups the best option when it comes to restoring files.
