Globe3 Ransomware

The Globe3 Ransomware is an updated version of the Globe Ransomware, a Trojan that encrypts your files to block you from opening them, allowing it to extort ransoms. Although the Globe3 Ransomware uses an upgraded algorithm for its encryption feature, the majority of its symptoms are consistent with past versions of this Trojan family, including pop-up ransom messages and changes to filename extensions. Because free decryption solutions are not always possible, you always should try to remove the Globe3 Ransomware with anti-malware protection preemptively.

Staying Competitive in the Trojan Rat Race

Although their victims tend to see only their end of the situation, a Trojan's design often owes just as much to the underground marketplace environs as it does to the intended impact on the infected PC. The Globe Ransomware's authors recently upgraded their family to a new release, the Globe3 Ransomware, which conducts all of the previously-noted attacks but also uses a more marketplace-standardized form of encryption.

The Globe3 Ransomware still uses the for-rent to third party con artists model of business, causing its possible distribution methods to vary wildly. Regardless of which threat actors deploy it, the Globe3 Ransomware always scans for local files (including network shares and any plugged-in external drives) and encrypts file formats, such as TXT, XLS and DOC. It uses the AES-256, a significant upgrade from the previous Blowfish that is nearly unique to the Globe Ransomware family. Different variants of the Globe3 Ransomware also append various text strings to their names, such as a '.decrypt2017' extension.

After blocking your local content and deleting any SVC-based backups, the Globe3 Ransomware creates the same HTA-based ransoming message that malware experts find in past versions of the Trojan. The instructions ask for Bitcoin payments to a wallet address, with the extortionist promising to restore your files by decrypting them afterward.

Three Time's the Charm for Cyber Security

Although its infection vectors are potentially unpredictable, most threat actors are likely of distributing the Globe3 Ransomware using previously-verified tactics, such as:

• Spam e-mail may disguise the Globe3 Ransomware's installer as a PDF or Word document related to your work or local deliveries. Most anti-malware programs should detect these Trojan droppers heuristically.
• Some businesses also may be hacked directly by con artists brute-forcing their account security. Strong passwords are essential to preventing these attacks.
• In rarer occasions, con artists may infect random traffic through exploit kits embedded on compromised sites. Taking basic security steps, such as disabling JavaScript when you don't need it, can alleviate most Web-surfing security loopholes.

The anti-malware company Emsisoft is maintaining download links for their free version of the Globe3 Ransomware decryptor. Most victims should try using these decryptors, whenever backups are not available. For those who do have backups, deleting the Globe3 Ransomware with anti-malware products and then restoring their files from their latest copies should resolve all damages.

The con artists aren't just competing with anti-malware solutions, but with each other, in the global marketplace for threats. PC users who don't protect themselves or back their data up may need to exercise patience until new decryption solutions can be developed for updates to old Trojans, just like the Globe3 Ransomware.

Technical Details