未知 家族详情

未知

极高 高活跃
首次发现 : 2024-02-02
勒索信 : INFORMATION.txt
算法 :
扩展名 : .vb_s,.wis,.Carver,.duralock05,.mcNQdMKpv,.Kastaneya,.devos,.xtbl,.anony,.arver,.encryptfile,.6GQ,.inl3,.colony96,.ink,.5ff84e06,.lcrypt,.resback,.cryptver,.mloch1,.JylGe,.cypt,.z6YTV,.lkGn520JI,.s,.REVRAC,.OVF,.fdid,.五位大小写字母及数字构成的字符串,.Z5N,.LOCKFILES,.FJZLN

情报摘要:

别名 :
IOC数量 :
5
受害记录 :
0
ATT&CK战术 :
0

概览

加密特征

暂无加密特征数据。

勒索信

勒索信文件 : INFORMATION.txt

WHAT OCCURRED? ------------------------------------------------------------ 1. We’ve INVADED your systems and SEIZED information. * We breached every segment of your infrastructure—including backup archives—and thoroughly examined your files. * We harvested all critical and sensitive records, transferring them to a secured, off-site cloud repository. 2. We’ve LOCKED down your documents. As you’re viewing this notification, be aware that every file and piece of data has been secured with the planet’s most powerful ransomware. Each item is now protected by a cutting-edge, military-level cipher—impossible to reverse without our assistance. Fortunately, we hold the key to restore your access. The only way is to contact us and pay in Bitcoin. Once the payment is complete, we will fully restore your network and servers within one business day. So what are the guarantees, you ask? --------------------------------------------------------------- Should you refuse to comply, we will expose your data publicly and spam your clients with targeted emails. Our team of seasoned OSINT specialists and media operatives stands ready to distribute the information across Telegram, Facebook, Twitter, and leading news outlets. The fallout could be catastrophic: you risk losing critical intellectual property and sensitive records, incurring massive incident-response costs, facing misuse of your information, eroding customer trust, damaging your brand’s reputation, and triggering legal or regulatory action. Once you’ve paid the ransom for the breach and decryption, we guarantee your data will remain confidential—our credibility depends on it. Consider this your final warning! --------------------------------------------------------------- Only an authorized executive—such as the CEO or a member of senior leadership—should engage with us. If you are not empowered to make these decisions, do not attempt to reach out! Any unauthorized interference could inflict severe damage on your organization. Notify your superiors and remain composed. Please do not harbor unrealistic fantasies,try to recover it yourself — if that's even possible, you will own all the BTC in the world. If you fail to complete the contact and make a payment within a week,Your decryption core files are worthless, and we will permanently delete them. REACH OUT IMMEDIATELY! Support contact email: samuelmarry@tuta.com ID:xxxxxxxxxxxxxxxxxxxx

勒索信文件 : 勒索病毒提示_README.txt

!_README.txt - 记事本 文件(F) 编辑(E) 格式(O) 查看(V) 帮助(H) WARNING! YOUR FILES ARE ENCRYPTED! Don't worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! Do not rename your files. It will damage it. The only way to decrypt your files safely is to buy the special decryption software from us. Before paying you can send us up to 2 files for free decryption as guarantee. No database files for test. Send pictures, text, doc files. (files no more than 1mb) You can contact us with the following email kittentor@proton.me Send us this ID or this file in first email ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

勒索信文件 : Helper.txt

Warning: Your files have been stolen and encrypted. If you want your files back, contact us at the email addresses shown below: Email: joedecryption@gmail.com Telegram: @joedecryption # In subject line please write your personal ID ID: xxxxxxxxxxxxxxxxxxxxxxxxx Warning: You will receive a discount if you contact us within 24 hours of decryption - Strictly try to avoid scam brokers or decryption companies, as they will only waste your money. Check Your Spam Folder: After sending your emails, please check your spam/junk folder regularly to ensure you do not miss our response. No Response After 24 Hours: If you do not receive a reply from us within 24 hours, please create a new, valid email address (e.g., from Gmail, Outlook, etc.) and send your message again using the new email address. P.S : No one but us has the ability to decrypt your files.

勒索信文件 : !_INFO.txt

ATTENTION! YOUR FILES WERE ENCRYPTED! Don’t worry, your files are safe, provided that you are willing to pay the ransom. - Don't rename encrypted files. - Don't change encrypted files. - Don't use third party software. It will damage your files, you will lost any chance to recover it. The only way to decrypt your files safely is to buy the special decryption software from us. We can decrypt a couple of files as guarantee. The size of each file must be not more than 2Mb. No database files for test. Send pictures, text, doc files. You can contact us with the following email wuguireco@gmail.com wuguireco@cock.li Send us this ID or this !_INFO.txt in first email ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

勒索信文件 : CONTACT.txt

I encrypted your system using a vulnerability in your system. If you want your information, you have to pay us. The ransomware project I used on your system is a completely custom project. It cannot be broken. It cannot be solved. People who say they can help you often come to us and ask for help on your behalf. In this case, you will have to pay more than you normally pay. If you contact us directly, the fee you will pay will be lower. You may not trust us. But we do our best to help you. We can open your data within 48 hours and direct you to a company we have helped. We want you to know that we have references all over the world. We will open the encrypted data. This is our job. We get paid and help. We close your security gaps. We ensure your security and give advice. What you will buy from us is not just your data. It is also your security. Our goal is to return the hacked systems to you. However, we want to be paid for our services. The most important thing we want from you. You have to be fast. React quickly when communicating and solve the situation quickly. We do not want to waste time. We can prove to you that we can open encrypted data. You can send us any sample file with file extensions .png, jpg, avi, pdf that you don't care about. We will send you the file back in working condition. Our file limit is 3. We can't open more for you for free. You can send us your database files. After we run your database file, we can send you a screenshot of the table you want. Email address: recovpuffin@gmail.com You Will Send Us This Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

技术细节

暂无技术细节数据。

威胁指标

邮箱

联系方式

samuelmarry@tuta.com

来源 : solarA004
首次录入 : 2024-02-02
最后更新 : 2026-10-25

邮箱

联系方式

piztoreco@gmail.com

来源 : solarA004
首次录入 : 2024-02-02
最后更新 : 2026-10-25

邮箱

联系方式

Peng1990@firemail.de

来源 : solarA004
首次录入 : 2024-02-02
最后更新 : 2026-10-25

邮箱

联系方式

kittentor@proton.me

来源 : solarA004
首次录入 : 2024-02-02
最后更新 : 2026-10-25

邮箱

联系方式

datahelper@cyberfear.com

来源 : solarA004
首次录入 : 2024-02-02
最后更新 : 2026-10-25

受害者信息

暂无受害者记录。

MITRE ATT&CK

暂无 ATT&CK 矩阵数据。

处置建议

暂无处置建议。

常见行业

暂无常见行业数据。

常见入口

暂无攻击入口数据。

操作协助

把热线、演示和资料入口拆开,让应急处置、产品评估和补充阅读各自清晰

电话咨询

出现加密、停摆或勒索提示时,优先直接联系应急响应团队。

400-613-6816

预约演练

如果你在评估产品、后台和家族库能力,可以先预约一个简短演示。

预约30分钟

查看资料

把文章、工具和方案入口集中到一起,方便团队继续同步研判。

进入资料中心

5000+

服务客户

99.8%

平均恢复率

<5min

首次响应

50+

安全专家