Fordan Ransomware

The Fordan Ransomware is one of the many file-lockers based on the STOP Ransomware project to be discovered in the past month. This file-encryption Trojan appears to be in distribution actively since there is at least one online report from a victim of the Fordan Ransomware – the user is based in Egypt, but this does not mean that the attacks are limited to this particular region.

Often, threats like this one might be distributed with the use of phishing emails that contain a corrupted attachment – the attackers also may use social engineering tricks to get the users to open the harmful file. Sadly, there is not much to do after the Fordan Ransomware is activated – it needs just a few minutes to complete its attack and leave the victim with a hard drive full of locked files. Whenever the Fordan Ransomware encrypts a file, it will add the ‘.fordan’ extension to its name so that it should be easy for the victim to recognize the corrupted files.

The Fordan Ransomware also leaves a ransom note with instructions on how to pay the ransom fee and get in touch with the perpetrators – we assure you that you should not do any of these things since it is very likely that you will end up being tricked. Cybercriminals cannot be trusted, and sending them money does not guarantee that you will get anything in return. The advice to users affected by the Fordan Ransomware’s attack is to dispose of the file-locker with the use of a suitable anti-malware tool and then explore alternative data recovery options.