Wayn Ransomware Encrypts Most Files

While analyzing new malware samples, we came across a ransomware variant called Wayn. This particular ransomware encrypts files and alters their filenames by appending the ".wayn" extension. Furthermore, Wayn leaves behind a ransom note in the form of a text file named "_readme.txt."

To illustrate how Wayn modifies filenames, let's take an example: it transforms "1.jpg" into "1.jpg.wayn," "2.png" into "2.png.wayn," and so on. Wayn belongs to the Djvu family, which has connections with other malicious software, including several infostealers. Threat actors have been observed distributing ransomware from the Djvu family in conjunction with these malicious programs.

The ransom note provides two email addresses (support@freshmail.top and datarestorehelp@airmail.cc) and urges victims to reach out to the attackers within 72 hours to avoid a higher payment of $980 for the decryption tools. It emphasizes that file decryption is impossible without purchasing the necessary tools (decryption software and a unique key) from the threat actors.

Additionally, the note offers victims the opportunity to send one file for free decryption before considering payment of a ransom.

Wayn Ransom Note Increases Ransom in Three Days

The full text of the Wayn ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-6Dm02j1lRa
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Can You Protect Your Important Data From Ransomware?

Safeguarding your important data from ransomware requires a proactive approach and a combination of preventive measures. Here are some effective ways to protect your data:

• Regularly Backup Your Data: Create regular backups of all your important files and ensure they are stored in a separate location or on an external device not directly connected to your network. This way, even if your files are encrypted by ransomware, you can restore them from backup without having to pay the ransom.
• Keep Your Software Updated: Maintain up-to-date operating systems, antivirus software, and other applications on your devices. Software updates often include security patches that address vulnerabilities that can be exploited by ransomware.
• Use Reliable Security Software: Install and regularly update reputable antivirus or anti-malware software on all your devices. These programs can help detect and block ransomware threats before they can infiltrate your system.
• Exercise Caution with Email Attachments and Links: Be cautious when opening email attachments or clicking on links, especially if they are from unfamiliar or suspicious sources. Ransomware is often distributed through phishing emails, so be vigilant and verify the authenticity of the sender before interacting with any potentially harmful content.
• Enable Firewall Protection: Activate and configure a firewall to control incoming and outgoing network traffic. Firewalls act as a barrier between your system and external networks, providing an extra layer of defense against ransomware attacks.