BleachGap Ransomware
The BleachGap Ransomware is a Windows file-locking Trojan that stops the user's files from opening by encrypting them and asks for money in a ransom note. Current versions show signs of beta testing, such as redundant notes, data encryption issues, and a lack of a wallet payment address. Users should still treat the Trojan as threatening and have appropriate anti-malware programs to remove the BleachGap Ransomware after infection.
An Incomplete Trojan Bleaching Data White
A work-in-progress Trojan usually is not that much less deadly than a completed version, as far as any victims should concern themselves. For the Windows-based, file-locker Trojan of the BleachGap Ransomware, its incomplete status shows what attacks are yet to come while offering victims a 'demonstration.' Any users dealing with current the BleachGap Ransomware releases should be happy that they're in the rare situation of having a file-locker Trojan whose locking feature isn't finishing the job.
The BleachGap Ransomware's mode of operation isn't too different from a Hidden Tear or Dharma Ransomware member. It encrypts data with an algorithm of unknown strength, adds unique extensions into their names ('lck'), and deletes the Shadow Volume Copy or the Restore Point data with a default utility. Then, it asks for money in a series of one hundred identical text notes. The BleachGap Ransomware's ransom is low, at under ten dollars USD in Bitcoins.
However, the BleachGap Ransomware isn't complete. Malware analysts indicate that the Trojan doesn't finish deleting the original, non-encrypted copies of all files, and also redundantly double-encrypts files. The lack of a Bitcoin wallet address also makes paying impossible, although this fact is reasonably beneficial for any victims.
Heeding Warnings about Trojan Development
The BleachGap Ransomware is mostly-harmless in its current form but is unlikely to stay that way forever. Windows users should consider backing up any documents and other work or recreational files to other devices for the easiest and cheapest recovery. The BleachGap Ransomware also represents a potential threat to network connectivity thanks to its making Registry changes to proxy and intranet settings.
Some of the BleachGap Ransomware's fake copyright credentials suggest that the threat actor may disguise and circulate it as another kind of freeware. Windows users who avoid unofficial or illicit downloads are at far less risk from downloading a disguised threat. Malware experts also encourage implementing precautions like enabling visible extensions, deactivating JavaScript, and keeping up with security updates.
Professional-quality anti-malware services should delete the BleachGap Ransomware without question as a danger to the computer and impede any encryption attacks. Like similar threats, the BleachGap Ransomware is small in size and may conceal its executable in arbitrary locations with uninformative names, and manual uninstalling isn't ideal for most users.
The BleachGap Ransomware has a few gaps in its payload, but any programmer could resolve them in minutes. This Trojan may not always be a crippled assailant, and so, users shouldn't leave their media at risk from it.
