ZEUSSEC1337 Ransomware is a New Chaos Clone Targeting Files for Encryption

ZEUSSEC1337 is the name of a new ransomware variant that belongs to the broader group of Chaos ransomware clones and offshoots.

ZEUSSEC1337 will scramble almost every file on the system it's deployed on. Encrypted file types include media files, documents, databases and executables, as well as archives.

Encrypted files will receive a new extension appended past their original one. The extension will consist of four randomly generated alphanumeric characters. This will turn a file called "image.png" into something similar to "image.png.v78e".

The ransomware will drop a file named "Bacabangtxt" without a dot separating the name from the txt extension that contains the ransom note. The same ransom note is also displayed on the system wallpaper.

The ransom note is written using language you would expect to see from someone who still thinks "leet speak" is relevant or cool in 2022. The full note goes as follows:

ZEUSSEC1337 WAS HERE
SORRY BRO YO UR IMPORTANT FILES ENCRYPTED 🙁
PAY ME BRO FOR BACK YOUR FILES
CONTACT ME BRO 🙁

EMAIL:ZEUSSEC1337 at GMAIL dot COM
TELEGRAM:@ZeusSec1337