Upsilon Ransomware Asks for $500 in Ransom
Our researchers discovered the Upsilon ransomware-type program while examining new submissions to online threat databases.
Table of Contents
What is the Upsilon ransomware and what does it do to files?
Upsilon launches by encrypting data and demanding payment for decryption. Upsilon encrypts files and adds a ".upsil0n" extension at the end of their filenames, such as "1.jpg.upsil0n" and "2.png.upsil0n". Afterward, a ransom note ("Upsilon.txt") is generated and the desktop wallpaper is adjusted.
The Upsilon ransom note reveals that the victim's files were encoded, commanding them to pay a ransom of $500 in Bitcoin cryptocurrency in order to receive the decryption software. If the ransom is not paid within three days, it will increase to a double charge of $1000.
Upsilon ransomware’s ransom note
The full text of the Upsilon ransom note reads as follows:
Woops,All Your Files Have Been Encrypted!
All Your Important Files Have Been Encrypted By Upsilon Ransomware.
You Won't Be Able To Decrypt Or Open Them.
Can I Get My Files Back?
Sure,You Can Decrypt All Your Files Easily With Our Decryption Software.
How Do I Pay?
Payment Is Accepted In Bitcoin Only.
You Only Have 3 Days To Submit The Payment,After That The Price Will Be Duplied.
We recommend not to remove upsilon.exe, or files will not be decrypted even if you paid!
Send $500 Worth Of Bitcoins To This Address: mpf7VMJEcqhAFEGKUkV2734535sRBxzbiN
For More Information About Bitcoin: hxxps://bit.ly/3Q3kQgE
How To Buy Bitcoins: hxxps://bit.ly/3G9LCzq
What are double extortion tactics in ransomware?
Double extortion tactics involve ransomware attackers gaining access to and exfiltrating data before encrypting it. This allows them to threaten victims with the possibility of publicizing their stolen data if the ransom is not paid. Double extortion has become increasingly common in recent years, as attackers leverage the fear of public exposure against victims.
This tactic increases the pressure on victims, who are now faced with two unpleasant options; pay the ransom or face potential reputational damage if their data is leaked. Double extortion significantly boosts an attacker's chances of receiving a payment as victims are more likely to comply when faced with both consequences – losing their data and having it exposed publicly.
The double extortion tactic has been used by gangs such as Maze, Sodinokibi, and Avaddon to collect large ransoms from vulnerable victims.
