Rzkd Ransomware Demands Nearly $1000 in Ransom

While examining malicious software samples, we encountered a ransomware known as Rzkd. This specific ransomware is designed to encrypt files and modify their names by adding the ".rzkd" extension. Additionally, Rzkd creates a ransom note, which can be located in a file named "_readme.txt."

To illustrate how Rzkd changes filenames, it transforms files like "1.jpg" into "1.jpg.rzkd," "2.png" into "2.png.rzkd," and so on. It's important to note that Rzkd belongs to the Djvu ransomware family. Often, threat actors distribute Djvu ransomware alongside information-stealing malware like RedLine or Vidar.

Inside the ransom note, the attackers provide instructions and include email addresses (support@freshmail.top and datarestorehelp@airmail.cc). They advise victims to reach out to them within 72 hours to avoid the ransom amount increasing. The initial decryption fee is $490. However, if victims don't respond within the specified timeframe, the ransom amount goes up to $980.

Furthermore, the note emphasizes that restoring the encrypted files is only possible with decryption software and a unique key obtained from the cybercriminals behind the attack. Additionally, the note hints at the potential for a free decryption of a single file, provided that the file doesn't contain valuable information.

Rzkd Ransom Note Demands Nearly $1000 in Three Days

The complete text of the Rzkd ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-RX6ODkr7XJ
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How is Ransomware Like Rzkd Distributed Online?

Ransomware like Rzkd is typically distributed online through various methods, including:

• Malicious Email Attachments: Cybercriminals often send phishing emails with attachments that contain ransomware. These emails may appear to be from legitimate sources and trick recipients into opening the attachments, which then execute the ransomware on their systems.
• Malicious Links: Phishing emails or messages may also contain links to malicious websites or downloads. Clicking on these links can lead to the downloading and installation of ransomware.
• Exploit Kits: Cybercriminals can use exploit kits, which are software packages designed to exploit vulnerabilities in outdated software or browsers. When a user visits a compromised website, the exploit kit can deliver ransomware to the victim's system without their knowledge.
• Drive-by Downloads: Similar to exploit kits, drive-by downloads occur when a user visits a compromised or malicious website, and the ransomware is automatically downloaded and executed on their device.
• Infected Software Installers: Some cybercriminals distribute ransomware by disguising it as legitimate software installers or updates. Users who download and run these infected files unknowingly introduce ransomware onto their systems.
• Malvertisements: Malicious advertisements, or malvertisements, can deliver ransomware when users click on them. These ads may appear on legitimate websites, making it challenging to distinguish them from genuine content.