{"id":543,"date":"2018-09-17T09:44:42","date_gmt":"2018-09-17T09:44:42","guid":{"rendered":"http:\/\/esolutions.lt\/blog\/?p=543"},"modified":"2018-09-17T09:44:42","modified_gmt":"2018-09-17T09:44:42","slug":"dharma-ransomware-activity-two-new-versions-in-less-than-a-week","status":"publish","type":"post","link":"https:\/\/esolutions.lt\/blog\/dharma-ransomware-activity-two-new-versions-in-less-than-a-week\/","title":{"rendered":"Dharma ransomware activity: two new versions in less than a week"},"content":{"rendered":"

Dangerous ransomware releases fifteen\u00a0 versions in less than two years<\/h2>\n

Esolutions have spotted two new versions of Dharma ransomware<\/a> attacking people all over the world. These newly coded variants emerged less than a week apart. Bringing two new file extensions in the similar pattern as previous intruders, these crypto extortionists encrypt data using both RSA and AES encryption algorithms. This makes encoded files even more difficult to decrypt. However, we are not suggesting to contact these hackers because people behind threats like this are not trustworthy and the alleged decryption tool may not even exist.<\/p>\n

The second week of September came with the news about Brrr ransomware that has .[paydecryption@qq.com].brrr file extension added on encoded files. This pattern of an\u00a0appendix is similar to other versions of the Dharma family. Less than a week after, Gamma ransomware was discovered with\u00a0.id-.[bebenrowan@aol.com].gamma file extension as a marker for encrypted photos, videos,\u00a0and documents. Another similar feature is two files for ransom note that has the same names since 2016: Info.hta\u00a0and FILES ENCRYPTED.txt.<\/p>\n

Same ransomware family has more than ten variants<\/h2>\n

The main ransomware family activity started with Dharma and the first attack in November 2016. Since then, there is a new version discovered every few months because CrySis\/Dharma developers are not sleeping. Every new version has code slightly changed, so encryption<\/a> is different and not so easily decryptable with previously developed decryption tools. Various cybersecurity experts have developed decryption tools for some versions, but since the code is changed with each release, it is not possible to use one decryptor for a few different versions.<\/p>\n

There is as many different extensions, contact emails,\u00a0and ransom notes as there are variants of ransomware. However, the content of the ransom message slightly changes while the main name of these files is not differing from the first one. Unfortunately, it looks that the hackers behind this cyber threat are not going\u00a0to stop shortly.<\/p>\n

Blocking Dharma ransomware before it is too late<\/h2>\n

Since this is a cyber threat, it comes to your computer\u00a0in various ways. Most common is spam email<\/a> attachments used to spread malware that installs ransomware or file attachments with the\u00a0direct malicious script. Because of this reason, various antivirus programs identify\u00a0the same threat in different names<\/a>:<\/p>\n