Ljubi Ransomware

▤ Summary

The threat acts as typical ransomware - after infiltrating the targeted computer, it will initiate an encryption process to lock the data stored there. Victims will no longer have access to their documents, PDFs, databases, archives, images, photos, etc. Reading Ljubi Ransomwares ransom-demanding message reveals that the attackers supposedly also have been able to exfiltrate important private documents and data. The note also establishes that the main communication channel with the hackers is a dedicated website portal hosted on the TOR network. However, if victims are unable to access the page, they can try to establish contact by messaging the hackers email address at ljubisupporte@protonmail.com.

▦ Linked Companies

EnigmaSoft

$1M to $5M