MonCrypt Ransomware

The MonCrypt Ransomware is a file-locking Trojan that's part of the Scarab Ransomware, a collective Ransomware-as-a-Service family. It belongs to the English-based side of this RaaS and can encrypt victims' media files for holding them hostage, along with supporting attacks. Users can best protect their data with backups and other pre-infection defenses, or anti-malware products for deleting the MonCrypt Ransomware upon its identification.

The Beetle Burrowing Inside Your Files Again

The Scarab Ransomware, a Ransomware-as-a-Service with dozens of campaigns under its belt, is staying active as a player in the threat landscape with a semi-random distribution. Unlike most competitors, like the STOP Ransomware or the Dharma Ransomware, the Scarab Ransomware family contains two different wings, one of which is Russian-based. However, the more prominent one, inhabited by newcomer the MonCrypt Ransomware, targets English-speaking users.

The MonCrypt Ransomware is a near relative of similar releases such as the Dom Ransomware, the 'Patern32@protonmail.com' Ransomware, the Rsalive Ransomware, or the dual-language Alilibat Ransomware. Encryption (using AES, like most file-locker Trojans) is the critical feature of the Windows program, which it uses for locking files by modifying their internal data. On a more superficial level, users also can find blocked documents, pictures, and other content through a search for the 'moncrypt' extension, which the MonCrypt Ransomware adds to the names along with related ransoming information.

Without surprise, malware analysts also note the functionality of the MonCrypt Ransomware's deletion of the Shadow Volume Copy or the Restore Point data, which it performs with hidden system commands. This attack destroys local backups, while the Trojan also endangers the Web-browsing environment by changing ZoneMap security settings. As a pair of final anti-security steps, the Trojan disables Windows' Automatic Startup Repair and suppresses boot-up error warnings.

Seeing Through a Bug's Camouflage

The choice of the MonCrypt Ransomware 'brand name' is one without a clear history behind it. While there is some past usage in 2017 with a now-defunct cryptocurrency management company, currently, moncrypt.com is a Japanese website for Java programmers. The English ransom note in the MonCrypt Ransomware's payload isn't a limiter on its distribution necessarily; file-locking Trojans with such messages propagate throughout most of the world. Free decryption solutions to the media-locking attacks of the MonCrypt Ransomware infections are not available currently and are unlikely of ever being so.

Even without specific information on how it's circulating, users can protect their files and computers from the MonCrypt Ransomware beforehand. Strong passwords will keep attackers from compromising entire networks' worth of data or brute-forcing their way inside initially. Scanning e-mail attachments and other downloads, and disabling JavaScript, Flash, and macros, will keep many drive-by-download vulnerabilities at bay. All users also should patch their software, particularly programs associated with server maintenance or document reading activities.

Windows anti-malware solutions from nearly any major vendor should delete the MonCrypt Ransomware after flagging it as a threat, which they should do before any encryption has a chance of happening.

The MonCrypt Ransomware is an investment in making illicit cryptocurrency profits, but how it plans on getting to the point of such extortion is slightly vague. Users only can prepare for all possible attack angles for keeping their files as safe as possible from the latest Ransomware-as-a-Service scourge.