Grovat Ransomware

The Grovat Ransomware is a file-locking Trojan from the family of the Djvu Ransomware or the STOP Ransomware. It may hide its locker attacks, which hold documents and other media hostage, behind pop-ups that imitate a Windows update or other service. Keep anti-malware products available for eliminating the Grovat Ransomware promptly and always have backups on other devices for keeping your media safe.

The RaaS Line of Assembly Churns Along

Ransomware-as-a-Service is providing more than adequate opportunities for threat actors without programming interests to conduct attacks using semi-sophisticated, streamlined file-locker Trojans. April is bringing more evidence that the family IDed as either STOP Ransomware or Djvu Ransomware is continuing at playing its part competing next to the Russian Scarab Ransomware, the global Crysis Ransomware and others. This observation is unsurprising, since new versions of it, such as the Grovat Ransomware, require little other than opening an e-mail account and a ransom-harvesting wallet.

The Grovat Ransomware blocks media on compromised systems so that its threat actors can demand ransoms for their custom unlocking services, which provide the matching decryption routine. Its family is somewhat unusual for employing one of two encryption routines – the online, traditional version, which relies on RSA security that it retrieves from the criminal's C&C server, and an offline variant with a default key for Internet-less environments. Failing to terminate the Trojan before it completes the attack will result in most of your files, such as documents, sound clips, databases, etc., suffering through encryption that blocks them from opening.

The threat actors deploying the Grovat Ransomware variant of its family may be using entirely new infection strategies, although there's little incentive for them doing so. Criminals relying on file-locker Trojans' payloads make significant use of corrupted e-mail attachments and brute-forcing logins (particularly for campaigning against business-sector networks). However, malware analysts judge that other attacks, such as exploit kits using browser vulnerabilities or fake torrent downloads, retain their relevance to these threats in 2019.

How to Tell Trojans to Just STOP

The harm that the Grovat Ransomware does to your files may be curable by freeware solutions thanks to the ongoing development of decryptors for the offline version of the STOP Ransomware. Users with content that's too important for risking its permanent loss should implement alternatives before exposing their systems to infection vectors. Backups on removable devices or cloud-based services will offer immediate recovery solutions for files without the need of paying a criminal or chancing a decryption solution that may not be compatible.

The previously-outlined infection strategies are relevant to most of the file-locking Trojans that malware researchers see equally, besides the Grovat Ransomware and its STOP Ransomware relatives. Software updates, strong passwords, and script-disabled Web browsers are highly-relevant defenses that any user can implement for keeping their hardware out of the reach of the Grovat Ransomware's circulation exploits.

The Grovat Ransomware may, like the equally-new-released the Raldug Ransomware, be compatible with decryption services that aren't ransom-based. But since users shouldn't bet on it since they're just as likely of being hit by familial variants with stronger encryption, like the Rumba Ransomware, the Blower Ransomware, and the Promos Ransomware of earlier this year.