Londec Ransomware

The STOP Ransomware list of members continues to grow with the Londec Ransomware. This file-encryption Trojan is spread via bogus email messages that urge the victim to download an attached file – often disguised as a legitimate document that attracts interest. Often, these documents are laced with a script, which, once executed, deploys the Londec Ransomware's payload and launches the corrupted file. Once the Londec Ransomware has been started, it begins to encrypt documents, images, videos, archives, etc. Usually, victims of variants of the STOP Ransomware lose the majority of valuable files on their hard drive and, unfortunately, their recovery might be an impossible task without receiving some assistance from the perpetrators.

The Londec Ransomware will mark the names of every file it encrypts via the '.londec' extension. It also creates the ransom message '_readme.txt,' which tells victims to contact gorentos@bitmessage.ch or gorentos2@firemail.cc. Of course, contacting the attackers is not enough – they also want to receive a hefty ransom payment ($490) via Bitcoin. In addition to this, they threaten to double the ransom amount (to $980) if the money is not transferred to their account within 72 hours.

We would not advise you to co-operate with the threat actors behind the Londec Ransomware project because there is a serious chance that they will not supply you with a decryptor even if you meet their demands. Your best bet as a victim of the Londec Ransomware would be to use an anti-virus software suite to dispose of the harmful file, and then look into alternative file recovery options.