Pennywise Ransomware

The Pennywise Ransomware is a variant of the Jigsaw Ransomware, a Trojan that can block or delete media according to its threat actor's parameters, such as targeting specific formats or folders. Because it represents an active and ongoing risk to the data on your PC, all users should abide by security standards that can block this threat from installing and avoid notable infection vectors, such as e-mail attachments. Malware experts also recommend being cautious about triggering further attacks unintentionally before you can remove the Pennywise Ransomware infections with a traditional anti-malware solution.

A Clown Performing for Your Files

Although its authors designed it as being a Halloween-themed threat presumably, the Pennywise Ransomware is a still in construction Trojan, with features drawing from the previous and somewhat infamous Jigsaw Ransomware. Recent samples of the Pennywise Ransomware's executable only operate in a debugging mode without any attacks. However, a complete version could indulge in activities that block or delete content on an infected PC, along with displaying ransom messages that it may use for locking the screen, as well.

Although the Pennywise Ransomware's only GUI, for the victim, is its ransoming pop-up, the Trojan also runs continuously in the background as multiple memory processes, all of which include names to misrepresent them as being other software, such as the Firefox browser. Besides being able to encode and block different files, including GIF pictures, DOCX documents, and other media, the Pennywise Ransomware also appends '.beep' extensions to their names. Like other Jigsaw Ransomware variations, the Pennywise Ransomware also has the potential capability of deleting one encoded file every hour and will erase an additional thousand every time it opens (which it does by default when Windows starts).

The Pennywise Ransomware's pop-up carries the threat actor's ransom demands and includes a timer referencing the file-erasing feature, along with a decryption field for unlocking your data. Due to being incomplete, the Pennywise Ransomware doesn't display a current ransom payment request, although malware experts anticipate future versions to use non-refundable methods like Bitcoin or Paysafecard. The only significant change from the old Jigsaw Ransomware is the Pennywise Ransomware's use of Pennywise the Clown-themed image, instead of the previous depiction of the villain of the movie franchise Saw.

Quitting the Clowning Around with Your PC

While the Pennywise Ransomware isn't ready for a live deployment, most of the work of programming its payload is already complete, thanks to the original Jigsaw Ransomware. Victims could trigger the mass erasure of their media unintentionally by rebooting their PCs and relaunching the Pennywise Ransomware accidentally. Even if they avoid any additional, file-deleting attacks, the Pennywise Ransomware can block local files permanently by encoding their contents. While free decryption programs do exist for the Jigsaw Ransomware, new updates like the Pennywise Ransomware often require additional work from cybersecurity professionals to patch the solutions into having renewed compatibility.

Threats of the Pennywise Ransomware's classification often circulate with the help of spam campaigns that use e-mails to trick their victims into opening unsafe content, such as document macros. Other attacks may use corrupted website scripts to exploit vulnerabilities in your PC that could enable the Pennywise Ransomware's automatic installation. Professional anti-malware products usually include multiple defenses against these attacks, and malware experts strongly recommend using them for uninstalling the Pennywise Ransomware with as little delay as possible.

The Pennywise Ransomware is a new face for an old fear: a con artist's plan for extortion that's held up by a foundation of hourly, file-destroying threats. Clownish performance pieces like the Pennywise Ransomware do well to show that forgetting to backup your files and mind your security guidelines can be mean many things, but funny isn't one of them.