Wwty Ransomware Demands $980 in Payment

A new ransomware variant known as Wwty was discovered in late 2023. Wwty functions by encrypting files and altering their filenames by adding the ".wwty" extension. Additionally, Wwty is designed to generate a text file named "_readme.txt" that contains a message outlining the ransom demands.

It's important to note that Wwty belongs to the Djvu ransomware family. Djvu ransomware is often distributed alongside data-stealing malware like RedLine or Vidar by malicious actors. To illustrate Wwty's file renaming process, it changes "1.jpg" to "1.jpg.wwty," "2.png" to "2.png.wwty," and so forth.

The ransom note provided by the attackers includes two contact emails: support@freshmail.top and datarestorehelp@airmail.cc. It strongly urges victims to contact the cybercriminals within a 72-hour window to avoid an increase in the ransom amount. Initially, the requested payment for the decryption tools is set at $490.

Furthermore, the note underscores that restoring the encrypted files is impossible without obtaining the decryption application and a unique key string from the threat actors. Additionally, it offers the option to decrypt a single file at no cost, with the condition that the chosen file doesn't contain critical or valuable data.

Table of Contents

Wwty Ransom Note Asks for $980

The complete text of the Wwty ransom note reads as follows:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-xoUXGr6cqT
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:

How Ransomware Like Wwty Distributed Online?

Ransomware is typically distributed online through various methods. Ransomware authors and cybercriminals are continually evolving their tactics, but some common distribution methods include:

Phishing Emails: One of the most common methods is via phishing emails. Attackers send deceptive emails that appear legitimate, often with malicious attachments or links. When the recipient opens the attachment or clicks the link, the ransomware is downloaded and executed on their system.
Malvertising: Cybercriminals can compromise legitimate online advertising networks and inject malicious code into ads. When users click on these infected ads or visit compromised websites, their systems can become infected with ransomware.
Exploit Kits: Attackers often exploit vulnerabilities in software or operating systems to deliver ransomware. They use malicious code to take advantage of unpatched systems. Keeping your software up to date is crucial in preventing such attacks.
Drive-By Downloads: This occurs when a user visits a compromised or malicious website, and the ransomware is automatically downloaded and executed on their device without their knowledge or consent.
Remote Desktop Protocol (RDP) Attacks: Attackers may target systems with weak RDP credentials or exposed RDP ports. Once they gain access, they can deploy ransomware directly onto the victim's system.
Watering Hole Attacks: In this method, attackers compromise websites that are frequently visited by their intended victims. When users visit these sites, their systems can become infected with ransomware.
Social Engineering: Cybercriminals may use social engineering techniques to trick users into downloading and running ransomware. This can involve fake software updates, fraudulent alerts, or fake tech support scams.