What is the Sneaky OBSIDIAN ORB Ransomware Threat?
OBSIDIAN ORB is a sneaky malware threat that is defined as ransomware. It is based on the Chaos ransomware, a well-known type of malicious software. Like other ransomware strains, OBSIDIAN ORB is designed to encrypt files on a victim's computer and demand a ransom for their decryption.
Once infected with OBSIDIAN ORB, the ransomware encrypts files on the victim's system and appends a four-character random extension to their filenames.
OBSIDIAN ORB Ransom Note
The ransom note delivered by OBSIDIAN ORB informs the victim that their files have been encrypted and demands a ransom of $10 USD for the decryption software. The note provides several payment methods, including Roblox gift cards, Paysafecard gift cards, a Steam key for the Payday 2 video game, Steam gift cards, or a pre-paid debit card (preferably Visa or Mastercard). The victim is given a 42-hour deadline to make the payment; otherwise, the note threatens that the files will remain inaccessible, and the data may be leaked online.
The note reads:
YOUR PC HAS JUST BEEN INFECTED WITH OBSIDIAN ORB RANSOMWARE!
------------------------------------------------------------
THIS MEANS, ALL OF YOUR FILES HAVE BEEN ENCRYPTED AND CAN ONLY BE DECRYPTED USING OUR PERSONAL SOFTWARE! THE PRICE FOR THIS SOFTWARE IS TO YOUR CHOOSING OUT OF THESE:
-10$ ROBLOX GIFTCARD (-)
-10$ PAYSAFE GIFTCARD (COULDNT FIND A LINK TO BUY ONE, BUY IRL THEN)
-1x PAYDAY 2 STEAM KEY (-)
-10$ STEAM GIFTCARD (-)
-10$ PRE PAID DEBIT CARD (VISA OR MASTERCARD ARE PREFERD)
SEND EITHER ONE TO emailmainemaildiscord@proton.me within 42h or your pc will be locked completly! YOUR KERNEL IS INFECTED! IF YOU RESET, YOUR PC WILL NOT WORK ANYMORE AND ALL OF YOUR INFO WILL BE SPREAD ON THE INTERNET!
It is important to note that ransomware attacks often do not result in successful data recovery even if the ransom is paid. Decryption is typically only possible with the assistance of the cybercriminals themselves, except in cases where severe flaws are present in the ransomware's implementation. Therefore, it is strongly advised against paying the ransom, as it supports illegal activities and does not guarantee the restoration of encrypted files.
Removing and Avoiding OBSIDIAN ORB
To mitigate the impact of OBSIDIAN ORB ransomware, it is crucial to remove the ransomware from the infected system. However, removing the ransomware will not automatically decrypt the compromised files. The recommended course of action is to restore the files from a backup if one is available. It is highly recommended to maintain regular backups in multiple separate locations, such as remote servers or unplugged storage devices, to ensure data safety.
Ransomware, including OBSIDIAN ORB, primarily spreads through phishing and social engineering tactics. Malicious programs are often disguised as legitimate software or bundled with regular files. Users should exercise caution while browsing the internet, avoid opening attachments or clicking on links in suspicious or irrelevant emails, and download software only from official and verified sources. It is also important to keep antivirus software updated and regularly scan the system for potential threats.
