How to remove Blitzkrieg ransomware

Blitzkrieg ransomware is file locking malware that modifies Windows registry to gain persistence

Blitzkrieg ransomware is a newly discovered cyber threat that focuses on money extortion. To do that, cybercriminals spread the malware with the help of a variety of deceptive methods and prevent users from accessing their photos, videos, music, databases, etc. with the help of file-locking algorithm AES.^[1] Data modified in such a way also receives a .bkc extension.

Once data is encrypted Blitzkrieg virus contacts a remote server that is controlled by hackers and distributes a ransom note HowToBackFiles.txt into each of the affected folders. The text file includes a message from hackers which explains to victims what happened to their data and how to get it back.

According to criminals, users should email them via Blitzkriegpc@protonmail.com, and the redemption price depends on the response time. Additionally, hackers also offer a test decryption service that allegedly guarantees that victims would not get scammed once they pay a ransom in Bitcoin or another cryptocurrency. Nevertheless, security experts^[2] highly discourage users from contacting the threat actors and rather focus on Blitzkrieg ransomware removal.

According to reports, most of the infections stem from China, although samples from other countries showed that the .bkc file extension and a different email address (blellockr@godzym.me) is being used by GlobeImposter 2.0 ransomware. Therefore, it might be that the latter and Blitzkrieg ransomware authors have something in common.

There are several ways you could get infected with Blitzkrieg ransomware. The most prominent crypto malware distribution methods include:

• Spam emails;
• Botnets;
• Fake updates;
• Exploit kits;
• Brute-force attacks;
• Web injects;
• Pirated software;
• Cracks or keygens, etc.

To avoid infections in the future, please check the second section of this article.

Once Blitzkrieg ransomware performs the file locking process, it drops a ransom note which states:

Attention !!!

All your files on this server have been encrypted.
Write this ID in the title of your message 

To restore the files need to write to us at email: Blitzkriegpc@protonmail.com

The price of restoration depends on how quickly you write tous. 
After payment we will send you a decryption tool that will decrypt all your files.

You can send us up to 3 files for free decryption.
-files should not contain important information
-and their total size should be less than 1 MB

IMPORTANT !!!
Do not rename encrypted files.
Do not try to decrypt your data using third-party software, this can lead to permanent data loss!
Your ID:

Please do not fall the victim of Blitzkrieg ransomware developers, as you might quickly get scammed. Bad actors are known to ignore their victims, even after the payment for the decryptor is performed. Besides, the act would only prove hackers that their project works as intended and they will keep on infecting more users in the future.

Therefore, you should remove Blitzkrieg ransomware from your computer with the help of security software – you might have to enter Safe Mode for that (we explain how to do that below). You should also scan your computer with FortectIntego to restore damaged system files (registry, startup items, scheduled tasks, etc.).

Tips to avoid getting infected with ransomware viruses

Ransomware is probably one of the most devastating cyber threats out there, as it might result in permanent data loss, as restoring it requires special conditions. This also applies to large-scale corporations and businesses, which lose millions of dollars each year for recovery procedures.^[3] Nevertheless, regular users might lose invaluable photos or other relevant information related to their work.

Therefore, it is best to stay away from ransomware in the first place. Here's what you can do to reduce the infection rate to a minimum:

• Install reputable security software and keep it updated;
• Enable Firewall;
• Make sure your operating system and the installed programs are regularly patched with security updates;
• Do not download cracks, keygens or pirated software installers;
• Use ad-blockers for high-risk sites;
• Do not open spam email attachments or click on suspicious hyperlinks inside;
• Use strong passwords for all your accounts.

Finally, you should always have a fresh backup of all your important files on an external drive or a cloud-based service.

Terminate Blitzkrieg ransomware and then proceed with file recovery process

As we already mentioned, you should not contact hackers and proceed with Blitzkrieg ransomware removal instead. For that, you should install anti-malware software, if you do not have on yet. We suggest using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes, although any other powerful tool of your choice might work. Be aware that ransomware viruses cannot be detected by all AV engines, so scans with multiple programs might be necessary.

Only after you remove Blitzkrieg ransomware, you can proceed with file recovery. If you had backups ready, now is the time to copy them over. Unfortunately, if you did not prepare a backup before the infection occurred, chances of retrieving data are minimal, as there is no decryption tool created by cybersecurity researchers (although it does not mean it will not be the case in the future). Nevertheless, you should try to use alternative recovery methods we provide below – it might help you to recover at least some of your files.