PUTIN Ransomware is Another Conti Variant

PUTIN is a ransomware belonging to the CONTI family that encrypts data and prevents victims from accessing it.

It appends the ".PUTIN" extension to filenames of all encrypted files, leaving behind a ransom note which demands payment for providing the decryption tool. The note also threatens to publish stolen emails, financial information, contacts and other information if the payment is not made within two days. To contact threat actors and pay the ransom, victims are provided with a Telegram username (@PutinRestore) and a list of currently published contacts on another Telegram channel (@PutinInformation).

Victims of PUTIN ransomware may find themselves unable to access their data after the encryption process is complete. The filenames of all encrypted files will contain the ".PUTIN" extension and a "README.txt" file that contains contact information will be dropped by the ransomware. In order to retrieve their data, victims must contact threat actors via the provided Telegram username and pay a ransom fee in exchange for the decryption tool.

The full ransom note used by the PUTIN ransomware reads as follows:

Putin Team attacked -

We have stolen a large amount of data, including personal emails, financial information, contacts, etc.

Files cannot be recovered without our decryptor.

We will publish the information in the media if you do not contact us and do not pay.

Data recovery will not be possible after 2 days.

Contact us in telegram(desktop.telegram.org) - @PutinRestore or hxxps://t.me/PutinRestore

We publish current contacts in Telegram channel - @PutinInformation or hxxps://t.me/PutinInformation