SaveLock Ransomware Encrypts Files

SaveLock, a type of ransomware, was uncovered during an examination of new file submissions. This malicious software is affiliated with the MedusaLocker ransomware family. SaveLock's primary function is to encrypt data and then demand ransoms in exchange for providing decryption keys.

In our evaluation system, this ransomware carried out encryption on files and modified their file names. The original file names were extended with a ".savelock52" suffix. For example, a file named "1.jpg" would be transformed into "1.jpg.savelock52," and "2.png" would become "2.png.savelock52," and so on for all locked files.

Upon completing the encryption process, a ransom demand message titled "How_to_back_files.html" was deposited. The content of this message clearly indicates that SaveLock focuses on targeting organizations and employs a strategy known as double extortion.

The ransom note issued by SaveLock declares that the victim's corporate network has been compromised, and their critical files have been encrypted using RSA and AES cryptographic techniques. The victim is strongly advised against altering or attempting to recover the affected files using third-party software, as such actions would permanently damage the data.

The message offers a complimentary decryption test that can be conducted on two to three unimportant files. However, the victim is informed that confidential and personal content has been extracted from the network. If they decline to pay the ransom, the stolen data will either be publicly disclosed or sold to third parties. The victim is urged to establish contact with the cybercriminals, and any delay exceeding 72 hours will result in an escalated ransom demand.

SaveLock Ransom Note in Full

The complete text of the SaveLock ransom note reads as follows:

YOUR PERSONAL ID:

YOUR COMPANY NETWORK HAS BEEN PENETRATED
All your important files have been encrypted!

Your files are safe! Only modified. (RSA+AES)

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.

No software available on internet can help you. We are the only ones able to
solve your problem.

We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..

We only seek money and our goal is not to damage your reputation or prevent
your business from running.

You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.

Contact us for price and get decryption software.

email:
ithelp08@securitymy.name
ithelp08@yousheltered.com

To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

How Can You Protect Your Data from Ransomware Attacks?

Protecting your data from ransomware attacks is crucial to avoid the potentially devastating consequences of having your files encrypted and held hostage. Here are essential steps you can take to safeguard your data:

Regularly Back Up Your Data:
Maintain up-to-date backups of all your important files on separate and offline storage devices or in the cloud.
Ensure backups are automated and run regularly to capture recent changes.

Use Reliable Security Software:
Employ reputable antivirus and anti-malware software to detect and block ransomware.
Keep your security software and operating system up to date with the latest security patches.

Educate Yourself and Your Team:
Train yourself and your employees or family members about ransomware threats and how to recognize phishing attempts.
Be cautious when clicking on links or opening email attachments, especially if they come from unknown sources.

Use Strong Passwords and Two-Factor Authentication (2FA):
Implement strong, unique passwords for all your accounts and change them regularly.
Enable 2FA whenever possible to add an extra layer of security to your accounts.

Patch and Update Software:
Keep your operating system, applications, and plugins updated to patch known vulnerabilities.
Disable unnecessary services and features that can be exploited by ransomware.