Unknown Ransomware

▤ Summary

This threatening software encrypts files and changes their filenames, adding the victims ID, the masterfix@tuta.io email address, and the ".unknown" extension to them. Victims are told to contact the threat actors via email (masterfix@tuta.io) or Telegram (@Stop_24) to receive further instructions. The main ransom note (info.hta) states that the price of the data decryption depends on how quickly victims contact the threat actor. These email messages often contain malware-laced executable files or corrupted macros embedded in documents to infect your system when victims open them. Drive-by downloads allow hackers to remotely install malware onto unsuspecting users computers without their knowledge or consent.

▦ Linked Companies

EnigmaSoft

$1M to $5M