K2 Ransomware

The K2 Ransomware is a file-locking Trojan that can keep content such as documents, images, or music from opening. As a variant of the VoidCrypt Ransomware, it also includes features for disabling server-specific applications and creates a ransom note for the victim. Victims with safe backups should have no recovery problems without paying, and most PC security products can safely remove the K2 Ransomware from infected systems.

Another Case of a Freeware Trojan Going Premium

After a mild debut on GitHub, the VoidCrypt Ransomware is becoming a more secure replacement for the easily-unlocked Hidden Tear project, which once was the default 'budget' source for threat actors with encryption-related plans. Like Hidden Tear, the VoidCrypt Ransomware variants (examples include the Decme Ransomware, the Exploit Ransomware, the Konx Ransomware, the Spade Ransomware, et al.) endangers Windows systems by encrypting and blocking files with little discrimination. Currently, the K2 Ransomware dates itself as the most-recent case, with samples from early December.

The Windows Trojan encrypts files and, in this fashion, 'locks' the user's documents, images, and other work, while also labeling them with extra extensions and random-appearing ID strings. The K2 Ransomware threat actor makes no alterations to the ransom note, as per similar cases like Decme Ransomware, excepting changes to e-mail addresses. This ransom note is in an HTA or advanced HTML format (for display as a pop-up window) and warns the victim that neglecting payment for two days will cause the threat actor's file-unlocking price to double.

Not all of the K2 Ransomware's features are as apparent to the eye as its file-locking one. Malware researchers recommend victims be mindful of the following additional risks:

• Disabled boot-up error messages
• Disabled Windows Automatic Startup Repair
• Deleted Wbadmin backups (Restore Points, etc.)
• Disabled Windows Firewall
• Disabled SQL Server administrative applications

These attacks cement the K2 Ransomware's position as the sole judge of access to any encrypted media for future ransoming.

Cleaning Up after a Trojan's Revival at Low Expense

Because any threat actor could re-purpose GitHub projects like the VoidCrypt Ransomware, the K2 Ransomware's infection strategies are highly unpredictable. All users should save backups securely on other devices for recovery in cases of attacks, without assuming that decryption is available – at all, let alone for free. Since even amateur programmers can secure encryption features with only a little time, attacks by the K2 Ransomware are likely to cause widespread file damage that's unrecoverable.

Malware researchers continue recommending against ransoms, which are high-risk exchanges for the victims. Windows users should enact security standards that prevent most possibilities of exposure to the K2 Ransomware from targeted or random exploits and attacks. Disabling scripts while Web-browsing, refusing illegal downloads, scanning files for threats, and being cautious around torrents, e-mails, and text messages are all highly advisable. Although attackers are most likely to get their most enormous ransoms from targeting business entities such as medical or even government networks, any user at home, using Windows, is just as much imperiled by file-locking Trojans.

Most high-quality anti-malware products will delete the K2 Ransomware, but removing Trojan infections doesn't unblock any already-encrypted files – hence the need for a backup.

A Trojan, freely downloadable, might start attacking victims at large from virtually any angle. Rather than correctly predicting such scenarios, Windows users should keep their vulnerability in mind and curate the risks that they take on the Web accordingly.