TRUST FILES 勒索软件毫无可信之处
勒索软件仍然是网络安全领域最具破坏性的威胁之一，新病毒不断出现，针对个人和组织。此类威胁之一就是 TRUST FILES 勒索软件，这是一种旨在加密受害者数据并要求受害者付款以恢复数据的程序。虽然勒索软件感染通常遵循熟悉的模式，但 TRUST FILES 引入了使其脱颖而出的独特元素。
在这里，我们深入探讨了 TRUST FILES 勒索软件是什么、它如何运作以及它的目的是什么。我们还探讨了它的潜在后果以及用户可以采取哪些措施来保护他们的数据。
Table of Contents
什么是 TRUST FILES 勒索软件？
信任文件勒索软件是一种恶意程序，由于它能够加密受感染系统上的文件并将其劫持，因此被归类为勒索软件。感染设备会更改目标文件的名称，并在其后附加唯一标识符、攻击者的电子邮件地址和扩展名“.XSHC”。例如，最初名为 document.pdf 的文件可能会显示为 document.pdf.[ID-40290F1].[TrustFiles@skiff.com].XSHC。
除了加密文件外，勒索软件还会修改受害者的桌面壁纸，并在名为 #README.hta 和 #README-TO-DECRYPT-FILES.txt 的文件中生成勒索信。这些信旨在告知受害者攻击情况、概述攻击者的要求，并警告受害者不要采取可能使恢复过程复杂化的操作，例如移动或重命名加密文件。
便条上的内容如下：
TRUST FILES
Dear Client
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was leaked,
- files are encrypted
The best and only thing you can do is to contact us to settle the matter before any losses occurs.
If You Want To Restore Them Email Us : Trustfiles@skiff.com
If You Do Not Receive A Response Within 24 Hours, Send A Message To Our Second Email : Trustfiles@onionmail.org
Or Contact via Telegram ID: hxxps://t.me/Trustfiles
1. THE FOLLOWING IS STRICTLY FORBIDDEN
1.1 EDITING FILES ON HDD.
Renaming, copying or moving any files could DAMAGE the cipher and decryption will be impossible.1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software can also break the cipher and file recovery will become a problem.
1.3 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk.
2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN
The security of your IT perimeter has been compromised (it's not perfect at all). We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks. We spent a lot of time researching and finding out the most important directories of your business, your weak points. We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, personal information.
- Audit reports.
- Audit SQL database.
- Any financial documents (Statements, invoices, accounting, transfers etc.).
- Work files and corporate correspondence.
- Any backups.
- Confidential documents.
2.3 TO DO LIST (best practies)
- Contact us as soon as possible. - Contact us only in our Mails or Telegram, otherwise you can run into scammers. - Purchase our decryption tool and decrypt your files. There is no other way to do this. - Realize that dealing with us is the shortest way to success and secrecy. - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently. - Avoid any third-party negotiators and recovery groups. They can become the source of leaks.3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 4 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
- Databases, legal documents, personal information.
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.
4. HOW TO CONTACT US
In our contact form or mail:
Contact via Telegram ID: hxxps://t.me/Trustfiles
Write us to the mails: Trustfiles@skiff.com or Trustfiles@onionmail.org
Write this ID in the title of your message Your ID is on the files
5. EVIDENCE OF THE LEAKAGE
5.1 You can request sample files chat to review leaked data samples.
5.2 Contact us only in our Mails or Telegram, otherwise you can run into scammers.
5.3 All leaked Data samples will be Disclosed in 4 Days if you remain silent.
5.4 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
6. RESPONSIBILITY
6.1 Breaking critical points of this offer will cause:
Deletion of your decryption keys.
Immediate sale or complete Disclosure of your leaked data.
Notification of government supervision agencies, your competitors and clients.
TRUST FILES 勒索软件如何运作
信任文件 勒索软件的勒索信强调受害者的文件已被加密，在某些情况下甚至被盗。为了重新获得访问权限，受害者被要求支付赎金，通常是以比特币等加密货币支付。其中一份针对个人或小型组织的勒索信甚至提供了有限数量文件的免费解密测试。
然而，第二份通知似乎针对的是大型企业，重点关注敏感数据盗窃。通知警告称，如果未能在四天内付款，则可能导致被盗信息泄露或出售。通知还警告不要使用第三方恢复工具，并表示此类操作可能会导致文件永久无法访问。
TRUST FILES 勒索软件针对的文件包括数据库、备份、法律文件、个人信息和公司信函——这表明攻击者的目标是最大限度地利用对受害者的控制。
TRUST FILES 勒索软件的影响
TRUST FILES 勒索软件攻击的影响不仅仅是带来不便。对于受害者来说，后果可能是毁灭性的，包括：
- 数据无法访问：除非使用攻击者持有的唯一密钥解密，否则加密文件将保持锁定状态。如果没有备份，受害者将面临是否支付赎金的艰难决定。
- 数据盗窃：被盗数据被泄露或出售的威胁又增加了一层压力，特别是对于处理敏感信息的企业而言。
- 财务和运营损失：支付赎金会耗费财务资源并资助非法活动。此外，攻击造成的运营中断可能会影响生产力。
重要的是，支付赎金并不能保证文件恢复。网络犯罪分子因在付款后仍不提供解密密钥而臭名昭著。
TRUST FILES 等勒索软件程序如何传播
勒索软件（例如 TRUST FILES）经常利用欺骗手段入侵系统。常见的传播方式包括带有恶意附件的钓鱼电子邮件、受感染的网站和欺诈性软件更新。攻击者还会利用过时系统中的漏洞或使用木马作为后门来发起感染。
一旦恶意文件被打开或执行，勒索软件就会开始加密文件并发起其要求。一些变体（包括 TRUST FILES）还可能通过本地网络或可移动设备（如 USB 驱动器）传播，从而进一步传播感染。
预防和应对 TRUST FILES 勒索软件
预防勒索软件感染需要保持警惕并采取主动措施。以下是防范 TRUST FILES 勒索软件等威胁的一些关键步骤：
- 定期备份：在多个位置（包括离线存储）维护重要文件的备份。这可确保无需依赖攻击者即可恢复数据。
- 电子邮件意识：避免打开附件或点击未经请求的电子邮件或消息中的链接。网络犯罪分子经常将恶意文件伪装成合法内容。
- 软件更新：保持操作系统、应用程序和安全软件为最新版本。修补漏洞可防止勒索软件的利用。
- 安全下载实践：仅从可信来源下载文件，避免使用非官方工具进行软件激活或更新。
如果发生感染，当务之急是删除勒索软件以防止进一步加密。虽然这不会恢复锁定的文件，但它可以最大限度地降低进一步损害的风险。受害者应避免支付赎金，因为它不仅资助了网络犯罪，而且不能保证解决问题。
关键要点
信任文件 勒索软件是利用漏洞获取经济利益的网络犯罪分子不断演变的策略的典型代表。通过加密和窃取文件，攻击者制造出一种多方面的威胁，需要立即采取行动并长期保持警惕。
虽然勒索软件构成了重大挑战，但遵守网络安全最佳实践并维护强大的数据备份可以降低风险。对抗 TRUST FILES 等威胁的斗争仍在继续，但知情且积极主动的用户最有可能保持安全。
