Play Ransomware Leaves Computer Victims With Few Options for Data Recovery

The Play Ransomware, a threat uncovered by security researchers recently, does not behave like a regular ransomware infection because it does not deliver a real ransom message. The message presented by the Play Ransomware only contains the program's name and the email address that victims should use to contact the attackers. Depending on the version of the threat, the email address may be different. However, the objective of the Play Ransomware is not different from the countless ransomware thr4ats pestering the Internet; encrypt the victims' files using a powerful and unbreakable encryption method that will make these files useless and then ask its victims to pay a fee as a ransom to get the decryption software that only the attackers have access to.

The Play Ransomware will append '.PLAY' as a new extension to the native file names of all encrypted files. As soon as the encryption process is concluded, the Play Ransomware delivers a 'Readme.txt' text file that supposedly guides the victims to the decryption steps. However, as was stated above, it only contains two email addresses, boitelswaniruxl@gmx.com and teilightomemaucd@gmx.com.

The Play Ransomware's encryption method does not leave its victims with too many options to get their data back; they can contact the attackers to see if the demanded ransom is affordable and pay it, which is a very dubious decision because in most cases the attackers do not send the decryption tool to their victims or they can choose to fight back by removing the Play Ransomware from their machines and looking for alternative methods to recover their data.