BKP Ransomware

The BKP Ransomware is a file-locking Trojan that's from the Dharma Ransomware sub-group of the Crysis Ransomware. Infections include symptoms such as encryption that blocks media-related content from opening, deleted backups, and ransom notes. Users should have anti-malware programs available for uninstalling the BKP Ransomware appropriately, as well as a non-local backup for any recovery of files.

A Familiar Series of Letters is Back for More Ransoms

A file-locking Trojan is courting confusion by reusing, either intentionally or accidentally, a string that some readers would associate with a past member of the Trojan's family. Although the cosmetic coincidence in the BKP Ransomware's payload makes for more problems for the victims, the underlying foundation of the Trojan's attacks, non-consensual encryption, are as consistent as ever. Malware experts do, however, warn that new variants of its family, a Ransomware-as-a-Service operation, could come with just-as-new, and unexpected infection exploits.

The BKP Ransomware belongs to the same Ransomware-as-a-Service family as the similar-looking bkp@cock.li Ransomware, and less identifiable relatives, like the LDPR Ransomware, the Heets Ransomware, and last year's '.cccmn File Extension' Ransomware. The members of this group of RaaS Trojans, labeled collectively as Crysis Ransomware (or Dharma Ransomware, for the sub-division), differ primarily by their encryption databases, along with smaller changes to the addresses and extensions that match with the renting, affiliate criminal. Unfortunately, recent versions like the BKP Ransomware use a secure database and aren't thwartable by free software.

Assuming that the BKP Ransomware does compromise a Windows PC and run uninhibited, it proceeds with blocking files through the well-known technique of encrypting them with AES and RSA algorithms. This conversion prevents documents, images, and other, digital valuables from opening. Meanwhile, the BKP Ransomware issues a backup-erasing command and drops ransom notes. Concerning the text string similarity, malware experts highlight that the BKP Ransomware is distinguishable from its old counterpart by the use of all-caps, instead of lowercase.

The Trouble that Three, Little Letters Cause

The vibrancy and maintenance of the BKP Ransomware's family are some of many setbacks for the validity of Windows' default backup features for preserving data without third-party support. The BKP Ransomware can remove the Shadow Volume Copy-related data and prevent users from accessing any default Restore Points. Since this issue is a regular feature in the RaaS industry, malware researchers suggest that all users have backups that include at least one, 'off-site' or non-local copy, such as a cloud server, DVD or USB.

Infection prevention is similarly valuable for users who may not get their files back, even if they consent to pay the ransom that the BKP Ransomware asks for in its text and Web page messages. Site admins can turn off RDP and avoid brute-force-risky passwords, while individuals may avoid unsafe downloads (such as illicit torrents) and e-mail links or attachments. Anti-malware programs aren't decryptors and can't unlock media, but malware researchers find rates for removing the BKP Ransomware via such tools highly in the victim's favor.

Something as small as a change in the casing is one of the few differences that the BKP Ransomware displays between itself and its forebears. In this situation, it makes little difference, but when the matter becomes as significant as finding out the proper decryptor, it can be life and death – for your files.