INFECTION ransomware – a cryptovirus that threatens to publish stolen data if the victims don't pay the requested ransom
INFECTION ransomware is a file-locking virus that steals private data from the infected computer before encrypting all non-system files and demanding a ransom. The stolen files are held as leverage until the victims would pay the ransom. If contact isn't made within seven of the attack, cybercriminals threaten to start publishing the files online.
The first thing that the virus does when it gains access to a targeted computer is scanning for frequently used files. As soon as some of them are downloaded onto a secure hacker server, all files are encrypted and renamed by appointing an .INFECTION extension to the original filenames.
When encryption is completed, ransom notes titled INFECTION-HELP.txt are generated and dropped in affected folders. Cybercriminals declare their instructions and demands within those notes, the most important being to contact them via three given emails (christopherlampar1990@tutanota.com, rodtherry1985@tutanota.com, lewisldupre@protonmail.com), or the stolen data will be leaked on hxxp://corpleaks.net website.
| name | INFECTION ransomware |
|---|---|
| Type | Ransomware |
| family | Nefilim ransomware |
| Appointed file extension | All victim files receive .INFECTION extension |
| Ransom Note | INFECTION-HELP.txt |
| criminal contact details | christopherlampar1990@tutanota.com, rodtherry1985@tutanota.com, lewisldupre@protonmail.com |
| Additional info | Cybercriminals state that they have stolen some data and will start leaking it on hxxp://corpleaks.net if the victims don't contact them and pay the ransom |
| Virus removal | We recommend eliminating the cryptovirus with trustworthy anti-malware software instead of dealing with the cybercriminals |
| system tune-up | When INFECTION ransomware removal is completed, use system repair tools like the FortectIntego app to take care of the system registry and other core settings |
INFECTION ransomware virus belongs to the NEFILIM ransomware family, which uses a combination of AES and RSA cryptography algorithms to lock victims' files. All of the members from this lineage, such as TRAPGET, FUSION, and others, steal some data before encrypting it to blackmail their victims.
The assailants start off in the ransom note by claiming that they've stolen gigabytes of valuable data from infected computers. They would provide proof of that when the victims would contact them. If the criminals won't be contacted, they threaten to start publishing the stolen information.
Then the creators of INFECTION ransomware continue by stating that all files on the devices are encrypted with a military-grade coding algorithm, and if the victims didn't keep backups, then the only way to regain access to those files is by purchasing their decryption tool.
To prove that such a tool exists and works, the cybercriminals offer to send them any two encrypted files from the infected devices via three given emails for free decryption. All further instructions regarding the ransom will be sent to the victims after they make contact.
After an agreement is reached with INFECTION ransomware developers, they promise to send the necessary decryption tool that will swiftly unlock the encrypted data on infected devices and declare that the stolen information will be securely deleted from their servers.
Research shows,[1] that companies who pay the criminals end-up losing twice as much money as the ones who didn't. So our recommendation is to remove INFECTION ransomware from all infected devices with trustworthy anti-malware software such as MalwarebytesMalwarebytes or SpyHunterCombo Cleaner.
When you're done with INFECTION ransomware removal, you should take care of the overall system health as cryptoviruses corrupt system files without encrypting them. Use system repair tools like the FortectIntego app to undo the damage that the system registry and other key system settings sustained.
Message in the INFECTION-HELP.txt ransom note reads:
Two things have happened to your company.
============================================
Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location.
When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction.
You can analyze the type of the data we download on our websites.
If you do not contact us we will start leaking the data periodically in parts.
============================================
We have also encrypted files on your computers with military grade algorithms.
If you don't have extensive backups the only way to retrieve your data is with our software.
Restoration of your data with our software requires a private key which only we possess.
============================================
To confirm that our decryption software works send 2 encrypted files from random computers to us via email.
You will receive further instructions after you send us the test files.
We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met.
If we do not come to an agreement your data will be leaked on this website.Website: hxxp://corpleaks.net
TOR link: hxxp://hxt254aygrsziejn.onionContact us via email:
christopherlampar1990@tutanota.com
rodtherry1985@tutanota.com
lewisldupre@protonmail.com
Improving cybersecurity level for home and office users
These days, cyberattacks are a common thing all over the world. Regular, everyday people are becoming victims of such crimes as much as big companies. The only sure way to evade cyberattacks is to work offline, but we provide some guidelines that would greatly improve your home and office cybersecurity since that is not possible.
First and foremost – invest in cybersecurity by teaching your staff how cybercriminals operate. Our research shows that most attacks still happen during phishing campaigns. Please read about it, spread the word to your colleagues, hire an IT specialist to take care of your computer networks, purchase some services from professional cybersecurity experts to teach you and your staff about cyberattacks.
Another crucial point in cybersecurity is to keep backups. And then backups of those backups. Keep in mind that cybercriminals can't get to offline storage devices. In case of a cyberattack, you'll be able to safely remove the infection, clean your computer systems, and restore the data without any consequences.
Acquire a professional anti-malware software that would watch your back. Compared to the average costs of a ransom[2], reliable anti-virus software price seems like a drop in the ocean. Purchase one, update its virus database everyday, run full system scans at least once a week.
Keep all software, from web browsers to the operating system, up-to-date. Please install the latest updates as soon as they are available (except unstable beta versions). Cybercriminals love to exploit bugs in outdated program versions, so be sure not to give them a chance.
Tutorial for INFECTION ransomware virus removal
Cyberattacks are a nightmare that's not going anywhere soon. People have to enlighten themselves about these attacks and how to evade them. Investing in cybersecurity is a must, either financially or physically (taking some time to teach yourself). The only right way to deal with cybercriminals is to get rid of their creations ASAP.
We recommend using trustworthy anti-malware software like MalwarebytesMalwarebytes or SpyHunterCombo Cleaner to remove INFECTION ransomware from infected devices. If you didn't keep backups, then before deleting the virus, export all encrypted data to offline storage. There's no decryption tool available now, but there's always hope.
Following a successful INFECTION ransomware removal, experts[3] suggest performing a system tune-up with the FortectIntego app or similar system repair tools to locate and restore any changes that the cryptovirus might have done to the system registry and other core system settings and its files.
Was this guide helpful?
Be the first to comment