Aim Ransomware

The Aim Ransomware is a file-locking Trojan that's part of a large Ransomware-as-a-Service, the Crysis Ransomware or the Dharma Ransomware. The Trojan blocks most media formats of files on the PC with encryption and sells a custom unlocking service for each victim. Users with backups can protect and recover their data without considering the ransom, while most anti-malware products will delete the Aim Ransomware.

What's Taking Aim at Your Data Now

With the regularly reasserted theme of anonymous and 'secure' e-mail services being tools for crime, the Dharma Ransomware's activity shows that customer safety can twist into public hazards. The Ransomware-as-a-Service entity, being based on the Trojan-generating kit, the Crysis Ransomware, is responsible for dozens to hundreds of variations, from the 1dec Ransomware to the Credo Ransomware, the Save Ransomware and the Aa1 Ransomware. The Aim Ransomware, with a slight change of services and extensions, is the newest of them.

The Aim Ransomware – unrelated to the instant messaging service that shares its name – attacks Windows PCs of most modern versions and uses Registry changes for creating background system persistence. The most relevant features to the victims include encryption, which converts files into non-opening copies, which it pairs with default backup deletion. After holding pictures, documents, and other media hostage in this way, the Aim Ransomware creates a ransom demand in a local Web page file.

There are few changes in the Aim Ransomware's campaign, which is par for the course with Ransomware-as-a-Services that often cycle through purely-cosmetic updates rapidly. The Aim Ransomware uses a non-standard, but still anonymous and free e-mail provider for the ransom negotiations, with no observable changes to the cost of its unlocking service. Any encrypted files will display the Aim Ransomware's extension ('aim'), but retain their earlier ones before it.

Ducking the Iron Sights of Trojan Encryption

The victim-targeting techniques of most Ransomware-as-a-Services harm 'low-hanging fruit.' Users with brute-forcible, bad passwords are at risk of having their accounts and networks hijacked by threat actors that use automated tools or more narrowly-targeted methods, like e-mail attachments. Software vulnerabilities, such as those in out-of-date programs or browser features like JavaScript, are notable reoccurring factors in file-locker Trojans' infections. Malware experts also issue a warning against using macros inside of documents carelessly or downloading illicit content, both of which are favorites in Ransomware-as-a-Service attacks.

Paying criminals for their decryption help can provoke more attacks or result in no solution despite the payment, usually through a non-refundable cryptocurrency. Unfortunately, the Aim Ransomware's family uses a secure encryption routine, in most cases, and few victims can unlock their files for free. Because of the high risk of local backup deletion, users always should have their backups on more than one device, such as a cloud service.

Malware experts regularly verify that most versions of the Dharma Ransomware include few or no noteworthy features for stealth, and rely on finishing their attacks before detection. Reliable cyber-security products designed for combating Trojans should quarantine or remove the Aim Ransomware automatically and quickly.

As a business, the Aim Ransomware depends on a trustworthy model that targets users who are a little too careless about preserving their media. Throwing a wrench into its business plans, and averting extortion, calls for nothing more or less than well-maintained and well-protected backups for everyone.