What is Zola Ransomware?

The Zola ransomware, a recent addition to the notorious Proton ransomware family, has emerged as a significant threat to computer users. Zola encrypts files and demands a ransom for their decryption. In our tests, this ransomware not only encrypted files but also appended the attackers' email address and a ".Zola" extension to each filename. For instance, a file originally named "1.jpg" would be altered to "1.jpg.[amgdecode@proton.me].Zola" post-encryption.

Ransom Note and Threats

Once Zola ransomware has encrypted the files, it changes the desktop wallpaper and creates a ransom note in a text file named "#Read-for-recovery.txt". The note informs victims that their files have been encrypted using AES and ECC cryptographic algorithms and that their data has been stolen. It offers to decrypt one file for free as proof of the decryption capability but warns against delaying the payment as this will increase the ransom amount. The note also cautions against modifying or deleting the encrypted files, as this could lead to permanent data loss.

The Zola Ransomware note reads like the following:

~~~ Zola ~~~
>>> What happened?
We encrypted and stolen all of your files.
We use AES and ECC algorithms.
Nobody can recover your files without our decryption service.

>>> How to recover?
We are not a politically motivated group and we want nothing more than money.
If you pay, we will provide you with decryption software and destroy the stolen data.

>>> What guarantees?
You can send us an unimportant file less than 1 MG, We decrypt it as guarantee.
If we do not send you the decryption software or delete stolen data, no one will pay us in future so we will keep our promise.

>>> How to contact us?
Our email address: amgdecode@proton.me
In case of no answer within 24 hours, contact to this email: amgdecode@onionmail.com
Write your personal ID in the subject of the email.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>> Your personal ID: - <<<<<
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

>>> Warnings!
- Do not go to recovery companies, they are just middlemen who will make money off you and cheat you.
They secretly negotiate with us, buy decryption software and will sell it to you many times more expensive or they will simply scam you.
- Do not hesitate for a long time. The faster you pay, the lower the price.
- Do not delete or modify encrypted files, it will lead to problems with decryption of files.

Decryption and Removal

Decrypting files encrypted by ransomware like Zola is typically impossible without the attackers' assistance, except in cases of severely flawed malware. However, even paying the ransom does not guarantee that cybercriminals will provide the decryption tools. Hence, it is strongly advised not to comply with ransom demands, as doing so supports criminal activity.

Removing Zola ransomware from the system is crucial to prevent further encryption, though it does not restore already encrypted files. Recovery is only possible if backups were made prior to the infection and stored securely.

Ensuring Data Safety

To safeguard data against ransomware attacks, it is essential to maintain backups in multiple locations, such as offline storage devices, remote servers, and other secure options. This practice ensures that even if ransomware strikes, data can be recovered without paying the ransom.

How Ransomware Spreads

Ransomware, including Zola, often spreads through phishing and social engineering techniques. Common distribution methods include:

• Loader/backdoor-type trojans
• Drive-by downloads
• Online scams
• Malicious attachments or links in spam emails
• Dubious download channels (e.g., third-party sites, P2P networks)
• Illegal software activation tools
• Fake updates

Malware is frequently disguised as or bundled with ordinary content and can come in various formats like ZIP archives, executables, documents, and JavaScript files. Infection typically occurs when a malicious file is executed or opened.

Protecting Against Ransomware

To protect against ransomware infections, exercise caution while browsing the internet. Be wary of incoming emails, messages, and links, especially from unknown or suspicious sources. Download software only from official and verified channels, and ensure all software is activated and updated using tools provided by the genuine developers.

Additionally, having a reliable and updated antivirus program is crucial. Regular system scans should be performed to detect and remove threats. If your system is already infected with Zola ransomware, run a scan with an anti-malware program to eliminate it automatically.

Conclusion

Ransomware like Zola represents a severe threat to data security, emphasizing the importance of proactive measures. By following best practices for data safety and maintaining a vigilant approach to internet usage, users can significantly reduce the risk of falling victim to such malicious attacks.