Pzcqyq Ransomware Belongs to Snatch Family

In the course of analyzing submitted samples, our team has successfully identified Pzcqyq, which is a variant of ransomware associated with the Snatch family. Our examination revealed that Pzcqyq utilizes encryption techniques to secure files. It appends the ".pzcqyq" extension to file names and generates a ransom note, specifically titled "HOW TO RESTORE YOUR PZCQYQ FILES.TXT".

To illustrate how Pzcqyq alters file names, consider this: it transforms "1.jpg" into "1.jpg.pzcqyq", and continues this pattern for files such as "2.png" becoming "2.png.pzcqyq", and so on.

The content of the ransom note informs victims that their network has undergone a simulated penetration test, during which their files were subjected to encryption. The perpetrators claim to have downloaded an array of data, exceeding 100GB. This includes personal data, marketing information, confidential documents, financial records, and duplicates of select mailboxes.

The cybercriminals issue a strong warning against any manual decryption attempts or utilization of third-party tools. They emphasize that only their decryption tool possesses the capability to effectively restore the files. They stress that any other software could potentially inflict further harm to the files, rendering them unrecoverable. The ransom note provides a pair of email addresses, "goodwork2020@mailfence.com" and "2020host2021@tutanota.com", for victims to communicate with.

In addition to this, the attackers present an offer to decrypt up to three files free of charge, provided their combined size remains under 1 MB. They also highlight the possibility of publicly exposing these encrypted files if they fail to receive a response within a span of three days.

Pzcqyq Ransom Note Claims 100 GB Stolen

The full text of the Pzcqyq ransom note reads as follows:

THE ENTIRE NETWORK IS ENCRYPTED YOUR BUSINESS IS LOSING MONEY!

Dear Management! We inform you that your network has undergone a penetration test, during which we encrypted
your files and downloaded more than 100GB of your data

Personal data
Marketing data
Confidential documents
Accounting
Copy of some mailboxes

Important! Do not try to decrypt the files yourself or using third-party utilities.
The only program that can decrypt them is our decryptor, which you can request from the contacts below.
Any other program will only damage files in such a way that it will be impossible to restore them.
Write to us directly, without resorting to intermediaries, they will deceive you.

You can get all the necessary evidence, discuss with us possible solutions to this problem and request a decryptor
by using the contacts below.
Free decryption as a guarantee. Send us up 3 files for free decryption.
The total file size should be no more than 1 MB! (not in the archive).

Please be advised that if we don't receive a response from you within 3 days, we reserve the right to publish files to the public.

Contact us:
goodwork2020@mailfence.com or 2020host2021@tutanota.com

How Can Ransomware Like Pzcqyq Infect Your System?

The methods through which ransomware like Pzcqyq can infiltrate your system are diverse and often exploit vulnerabilities in software, human behavior, or network security. Some common infection vectors include:

• Phishing Emails: Cybercriminals often send deceptive emails with malicious attachments or links. These emails may appear legitimate and urge recipients to click on the attachments or links, which then execute the ransomware payload.
• Malicious Downloads: Visiting compromised websites or downloading software, files, or media from untrusted sources can lead to ransomware infections. These downloads may contain hidden malware that activates upon execution.
• Drive-by Downloads: Malicious code can be injected into legitimate websites. When you visit such a site, the malware gets downloaded and executed without your knowledge or consent.
• Exploit Kits: These are packages of tools that target vulnerabilities in software applications, often used by cybercriminals to deliver ransomware via compromised websites.
• Remote Desktop Protocol (RDP) Attacks: If your system's RDP is not adequately secured, attackers can gain access and deploy ransomware.
• Malvertising: Attackers can place malicious advertisements on legitimate websites. Clicking on these ads can lead to ransomware infections.
• Social Engineering: Attackers can exploit human psychology to trick users into downloading or executing malware, often by posing as legitimate organizations or individuals.
• Software Vulnerabilities: Exploiting unpatched vulnerabilities in operating systems or software applications is a common way for attackers to gain unauthorized access.