Infovip@airmail.cc Ransomware

The Infovip@airmail.cc Ransomware is a part of the Scarab Ransomware family: a collection of file-locking Trojans that its authors rent to other threat actors for distributing extortionist campaigns. The files that the Infovip@airmail.cc Ransomware attacks will fail to open and may show significant alterations to their names or extensions. Have your anti-malware products remove the Infovip@airmail.cc Ransomware on sight and use backups or free decryption software, as appropriate, for restoring any lost files.

The Information on a New Beetle Coming Out of the Woodwork

The Russo-English family of file-locker Trojans known by Scarab Ransomware is the birthing grounds for another Trojan variant that's attacking English speakers. While, unlike the similarly-dated Scarab-Oneway Ransomware, doesn't use multi-linguistic messages, its attacks continue endangering PCs by using a non-consensual encrypting routine as a way of blocking data by its format and location. Malware experts are warning that this threat may not be compatible with current decryption applications for its family, due to recent changes in the implementation of the encryption.

The Infovip@airmail.cc Ransomware's encryption feature runs without a user interface and uses an AES-256-based algorithm for locking different types of digital content. While the attack ignores default Windows components, the Trojan does encode Word or Adobe PDF documents, music, pictures, compressed archives, audio and video formats. While there are some reports of the Infovip@airmail.cc Ransomware not using the traditional, Base64-style filename-conversion, as well, malware experts do verify that it adds an extension (the e-mail address in its name).

Almost all versions of the Scarab Ransomware create Notepad messages for delivering their ransoming instructions, and the Infovip@airmail.cc Ransomware doesn't alter this feature substantially. The victims are told to contact the e-mail address for purchasing a decryption solution, but the Infovip@airmail.cc Ransomware doesn't give any other details on the currency type or amount to pay. Readers should remember that some if not all members of the Infovip@airmail.cc Ransomware's family are compatible with decryption programs that the cyber-security industry offers without any charges.

Shooting Cloned Trojans Out of the Air

The Infovip@airmail.cc Ransomware's campaign is minimally different from that of other Scarab Ransomware updates, from the Scarab-Bitcoin Ransomware and the Scarab-Leen Ransomware to the slightly older Scorpio Ransomware. Its attacks are for blocking or deleting local data as a bargaining point, but remote backups are a widely-available solution that lets any victims recover their work without paying. Meanwhile, criminal-purchased decryption tools are not compatible with the encrypted media necessarily, and the threat actor is under no pressure for delivering this software.

Out of the infection methods malware researchers are tracking, the following two are in notably high use with most Scarab Ransomware variants:

• Default, short, and guessable passwords help threat actors conduct brute-force attacks for compromising a remote machine and installing other software automatically.
• In circumstances where password protection blocks these attacks, criminals may prefer attaching corrupted, disguised files to spam e-mails, which can drop the Infovip@airmail.cc Ransomware through Word macros or PDF vulnerabilities.

Although all users should abide by reasonable network security standards, anti-malware programs also have reasonable detection rates for the Scarab Ransomware family. Uninstalling the Infovip@airmail.cc Ransomware with appropriate security software can guarantee the safe removal of both it and any remaining threats, although users, still, will need to take steps for their data's restoration.

While new threat actors are putting their money towards Trojans like the Infovip@airmail.cc Ransomware, PC owners should be backing up their media with equal care. Forgetting to keep your work safe is an understandable but, often, irreversible mistake against the Ransomware-as-a-Service industry.