Proton Ransomware Will Lock You Out of Your Files

During our team's inspection of VirusTotal's recently submitted malware samples, we discovered Proton ransomware. Proton is known for its ability to encrypt files and alter their names by adding the email address kigatsu@tutanota.com, a unique victim ID, and ".kigatsu" extension. In addition, the ransomware creates a ransom note titled "README.txt."

For example, Proton ransomware will modify a file name like "1.jpg" to "1.jpg.[Kigatsu@tutanota.com][719149DF].kigatsu". The ransom note claims that the victim's files were encrypted and stolen using advanced AES and ECC algorithms, rendering them irretrievable without their decryption service.

To convince the victim of their capability to recover the files, the attackers provide a guarantee to decrypt a sample file with a size smaller than 1 MB. The ransom note includes two contact methods, a Telegram ID (@ransom70) and two email addresses (kigatsu@tutanota.com and kigatsu@mailo.com), and encourages the victim to pay the ransom promptly to receive a decryption tool at a lower price. Additionally, it warns victims not to modify or delete encrypted files since it may impact decryption.

Proton Ransom Note Offers to Decrypt Single File

The full Proton ransom note reads as follows:

Proton
What happened?
We encrypted and stolen all of your files.
We use AES and ECC algorithms.
Nobody can recover your files without our decryption service.

How to recover?
We are not a politically motivated group and we want nothing more than money.
If you pay, we will provide you with decryption software and destroy the stolen data.

What guarantees?
You can send us an unimportant file less than 1 MG, We decrypt it as guarantee.
If we do not send you the decryption software or delete stolen data, no one will pay us in future so we will keep our promise.

How to contact us?
Our Telegram ID: @ransom70
Our email address: Kigatsu@tutanota.com
In case of no answer within 24 hours, contact to this email: Kigatsu@mailo.com
Write your personal ID in the subject of the email.

Your personal ID: -

Warnings!

• Do not go to recovery companies, they are just middlemen who will make money off you and cheat you.
  They secretly negotiate with us, buy decryption software and will sell it to you many times more expensive or they will simply scam you.
• Do not hesitate for a long time. The faster you pay, the lower the price.
• Do not delete or modify encrypted files, it will lead to problems with decryption of files.

How Can You Protect Your Valuable Data From Ransomware Like Proton?

Ransomware attacks like Proton can be devastating, and protecting your valuable data is crucial. Here are some steps you can take to protect your data from ransomware:

• Backup your data regularly: Regularly backing up your data ensures that you always have a clean copy of your files that can be restored if your system is compromised. Make sure to keep your backup in a separate location from your primary system, such as on an external hard drive or in the cloud.
• Use reputable security software: Install reputable antivirus and antimalware software and keep it up to date. Make sure to configure the software to scan for and detect ransomware.
• Keep your operating system and software up to date: Cybercriminals often exploit vulnerabilities in outdated software to infect systems with malware. Keeping your software and operating system up to date with the latest security patches can help prevent these attacks.
• Be cautious with email attachments and links: Cybercriminals often use phishing emails to spread malware, including ransomware. Be cautious with email attachments and links, especially if they are from unknown or suspicious sources.
• Educate yourself and your employees: Educate yourself and your employees about the dangers of ransomware and how to avoid it. Train them to recognize phishing emails and to be cautious when downloading or opening attachments or clicking on links.
• Use strong passwords and two-factor authentication: Strong passwords and two-factor authentication can help prevent cybercriminals from accessing your systems and data.

By following these steps, you can significantly reduce the risk of a ransomware attack and protect your valuable data from cybercriminals like Proton.