.frendi Ransomware

The .frendi Ransomware is a file-locking Trojan from the Dharma Ransomware update to the Crysis Ransomware's family. The .frendi Ransomware can deliver attacks that lock your files with encryption automatically, along with supporting features such as changing their names and removing their backups. Windows users should save backups on other devices for security purposes and use anti-malware solutions for removing the .frendi Ransomware properly.

The Next Name in Fear for Your Files

Locking media for money is getting a new instigator in the form of a recent build from the Crysis Ransomware's Ransomware-as-a-Service generator. Like nearly all of the modern versions of the family, this version, the .frendi Ransomware bases itself off of the secured Dharma Ransomware edition that isn't susceptible to old decryption solutions. Some members of the cyber-security community speculate of additional changes that may make the .frendi Ransomware a relative of the Phobos Ransomware, a well-known Globe Ransomware copycat, although malware analysts have yet to confirm such an update.

Whether that last estimate is factual or not, the .frendi Ransomware continues leveraging AES-based encryption attacks that help it lock hundreds or even thousands of documents, images, and other media on the Windows systems automatically. The .frendi Ransomware also replaces the filename with an ID serial, the threat actor's e-mail, and a 'Frendi' extension, hence its name. The use of an AOL account for the e-mail contact is an unprofessional element in this campaign, and malware experts usually note it as the mark of a mostly-inexperienced threat actor.

The victims can find two different ransom notes, either on the desktop or in folders with encrypted files. One of these documents uses a Notepad TXT format, and the other, an advanced HTML (or HTA) pop-up. Following the payment instructions is a risk that may not pay off for users trying to buy a decryptor, but there is no public decryption alternative for restoring any files. However, malware experts see no reason for discouraging the use of the 'free samples' that the threat actors of the .frendi Ransomware's family traditionally provide.

Stopping a Ransomware Business Just as It Opens

Ransomware-as-a-Service lends its services out to other threat actors relatively indiscriminately, as long as they pay an opening fee or surrender a percentage of the ransom. This business model can lend itself to many distribution modes, but malware researchers find attacks from RaaS threats focusing on either spam e-mails or brute-force attacks, overall. Securing your login credentials with unique, complex passwords, and maintaining care around any e-mail-sent attachments or links will keep your PC safe from the bulk of attacks.

The encryption in use by the .frendi Ransomware's family blocks the file's data with an AES algorithm before securing the key with a customized RSA one. Since there isn't a free decryption service that could unlock such an attack, without information that's in the threat actors' ownership, the users always should back up their work as a failsafe. For infection prevention or disinfection, most anti-malware products can delete the .frendi Ransomware and other members of its family, from the modern Heets Ransomware and the KARLS Ransomware to the Bizer Ransomware or the Cobra Ransomware, without issues.

The .frendi Ransomware is one finger of a beast with many hands, all of which grasp your digital media as an intermediary for making money. Ransomware-as-a-Service is too large an industry to counteract without the users doing their part to stop attacks with all due care.