Exploit Ransomware

The Exploit Ransomware is a file-locking Trojan from the VoidCrypt Ransomware family. Like other members, the Exploit Ransomware blocks the user's media files, adds new extensions to them, and creates HTA ransom messages that offer an unlocking service to victims. Most high-quality anti-malware solutions will delete the Exploit Ransomware automatically, although users also should have secure backups for any critical files.

The Void Expands with New Trojan Stars

Just as stars might be born and die in the expanse of space, Trojan families with infinite room for growth can create new starring players over days, months, or years. The VoidCrypt Ransomware is, ironically, a smaller family of file-locker Trojans, but malware researchers see ongoing activity from this group. Late examples might include the Exploit Ransomware, which flares up as the Lalaland Ransomware simultaneously, and somewhat after Spade Ransomware.

The Exploit Ransomware still targets Windows systems, where the majority of PC users with files worth ransoming work their livelihoods. Features of the Exploit Ransomware's family that malware experts continue confirming include its encryption routine for blocking files, extension additions (e-mails, IDs, and variants' campaign names) and the creation of HTA ransom notes. The Exploit Ransomware's version of the letter includes a deadline before raising the price, a common ploy among threat actors for forcing ransoms before the victims can reconsider.

Some of the Exploit Ransomware's behavior also shows off lesser-analyzed features in the VoidCrypt Ransomware (or Void Ransomware) family. It may terminate processes related to server management programs for improving its access to files, delete Windows backup data and suppress all boot-up error messages. Although none of these abilities are highly-unusual, malware experts note the overall effect of maximizing damage to files while keeping victims from noticing the attack as it proceeds.

Covering Your Files During a Celestial Event

The birth of a new Trojan from an established family, like a solar flare phenomenon, is predictable in abstract, but less so in specifics. The Exploit Ransomware may install itself through differing exploits appropriate for Windows systems and could pose an equal danger to home PC users, businesses' networks, or unprotected Web servers. For the latter, password security and due care around e-mail attachments and links remain high priorities.

All users also should partake of traditional defenses against the exploits that traffic in file-locker Trojans and other threats that represent significant security hazards. In particular, malware researchers suggest:

• Enable visible extensions to detect inaccurate file formats.
• Disable high-risk features, a la Flash or JavaScript.
• Install security-related software updates promptly.
• Avoid illicit downloads like game cheat engines.
• Be cautious about opening or enabling additional content inside of documents or spreadsheets from unconfirmed senders.

Backups on other devices will help victims recover their files without paying a ransom. Further protection from effectual anti-malware programs should result in deleting the Exploit Ransomware before infections get out of hand.

The Exploit Ransomware bears much resemblance to its close sibling, the Lalaland Ransomware, but its feature usage is depressingly enlightening. Victims have more worth worrying about than just encryption, even though for most users, that attack, alone, is more than enough of a problem.