SpartCrypt Ransomware

The SpartCrypt Ransomware is a file-locking Trojan that's a modification of the formerly-public Hidden Tear. The SpartCrypt Ransomware can use encryption for blocking files on your computer, create ransom notes and change filenames. Users should have anti-malware programs ready for removing the SpartCrypt Ransomware as necessary, supplemented by backups for recovering any encrypted content.

A Spartan War of Aggression on Your Files

Hidden Tear isn't nearly as prominent in the file-locking Trojan landscape as it used to be, mostly thanks to the glut of Ransomware-as-a-Service options for criminals. However, for con artists disinclined of paying for renting others' Trojans, it remains a powerful tool and coding resource. Examples of campaigns using this Turkish project for extortion include the Israbye Ransomware, the Black Worm Ransomware, the KwaakLocked Ransomware, the Marozka Ransomware, and as of November 2019, the SpartCrypt Ransomware.

The SpartCrypt Ransomware (or 'Spart Cript,' as per its ransom note), is a file-locking Trojan that uses the AES encryption without the usual, extra key-based security that Ransomware-as-a-Service families utilize. The encryption routine targets media, such as documents, throughout the computer, and 'locks' them. Although the simplest way of identifying what files are hostages is through the 'Encrypted' extension, an added ID, and a Protonmail-based e-mail address, these details don't impact the encryption that keeps files from opening.

Malware experts also find a few false 'bread crumb trails' among the SpartCrypt Ransomware's symptoms. Its payload includes a text message and a separate pop-up, both of which use ransom note templates from previous threats like the Dharma Ransomware. Unless victims notice the difference of addresses, they could believe themselves under attack by a Ransomware-as-a-Service, which is, frequently, the cause of media loss that's permanent without the attacker's assistance with the decryption key.

Shrinking a Trojan's Viable Battlefield

Users are always counseled to have backups of their work that they keep on other devices, ranging from USBs and DVDs to cloud or NAS-style services and repositories. Such precautions provide a highly-reliable way of getting files back after an attack without concerns about the security or relative impenetrability of an encryption algorithm.

Although malware experts always recommend the above guidelines, they also rate the SpartCrypt Ransomware's encryption as not secure currently. Users can contact cryptography-experienced security researchers for a possible solution to unlocking anything that the SpartCrypt Ransomware encrypts. This advantage is typical of some versions of Hidden Tear, but not, readers should remember, valid of the far more numerous Ransomware-as-a-Service businesses equally.

Currently, the SpartCrypt Ransomware is only available in a Windows-based format. Users can protect their systems appropriately with anti-malware tools that should delete the SpartCrypt Ransomware before it can begin harming any media.

The SpartCrypt Ransomware is a visually-deceptive Trojan, but more likely, due to lack of motivation on the author's part, rather than any clever tactic. What's important is that those whom it attacks remember never to judge a Trojan by its cover, since the inside and outsides can differ quite a bit.