Rzfu Ransomware Joins Djvu Family of Clones

While analyzing new malware samples, we encountered the Rzfu ransomware, which belongs to the Djvu family. When this ransomware infiltrates a computer, it encrypts files and adds the ".rzfu" extension to their original filenames. For example, "1.jpg" would be transformed into "1.jpg.rzfu," and "2.png" would become "2.png.rzfu."

In addition to file encryption, Rzfu also generates a ransom note, which is a text file named "_readme.txt." Additionally, the distribution of Rzfu may involve the inclusion of information-stealing malware such as Vidar and RedLine.

The ransom note emphasizes that the decryption process relies entirely on specific decryption software and a unique key. It instructs victims to contact the attackers through provided email addresses (support@freshmail.top or datarestorehelp@airmail.cc) for further guidance.

Furthermore, the ransom note presents two different ransom amounts ($980 and $490), suggesting that victims may be eligible for a discounted rate on the decryption tools if they reach out to the attackers within a 72-hour timeframe.

Table of Contents

Rzfu Ransom Note Copies Djvu Template

The full text of the Rzfu ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-RX6ODkr7XJ
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can Ransomware Infect Your System?

Ransomware can infect your system through various means, and attackers are constantly evolving their tactics to exploit vulnerabilities. Here are some common methods through which ransomware can infiltrate your system:

Phishing Emails: Phishing emails are a prevalent method for ransomware distribution. Attackers send malicious emails that appear legitimate, often with enticing subject lines or attachments. Clicking on links or downloading attachments from these emails can lead to the installation of ransomware.
Malicious Websites: Visiting compromised or malicious websites can expose your system to drive-by downloads. These websites exploit vulnerabilities in your browser or plugins to deliver ransomware without any user interaction.
Malvertising: Cybercriminals use malicious advertisements on legitimate websites to distribute ransomware. Clicking on these ads can redirect you to sites hosting exploit kits that deliver the malware.
Exploit Kits: Exploit kits are tools that target known software vulnerabilities. If your system has unpatched or outdated software, ransomware can exploit these vulnerabilities to gain access.
Remote Desktop Protocol (RDP): Attackers may use brute force attacks or stolen credentials to gain access to computers with open RDP ports. Once inside, they can deploy ransomware on the compromised system.
Software Downloads: Illegitimate or cracked software downloaded from unofficial sources can contain hidden ransomware payloads. Always download software from trusted sources.
Malicious Attachments: Opening attachments from unknown or suspicious sources can introduce ransomware. These attachments may be disguised as legitimate documents or files.