BOMBO Ransomware

The BOMBO Ransomware is a new file-encrypting Trojan that targets a wide variety of filetypes. Ransomware threats are among the most popular malware threats. The BOMBO Ransomware is a copy of the infamous Dharma Ransomware.

Propagation and Encryption

The BOMBO Ransomware may be spread via fake emails containing corrupted attachments/links, torrent trackers, malvertising operations, bogus software downloads and updates, and countless other propagation methods. Threats like the BOMBO Ransomware often go after a very wide variety of filetypes to cause maximum damage to the infected machine. It is likely that the BOMBO Ransomware encrypts .doc, .docx, .pdf, .ppt, .pptx, .xlsx, .xlsx, .rar, .zip, .png, .jpeg, .jpg, .mp3, .mov, .mp4, .gif, etc. Upon infiltrating your computer, the BOMBO Ransomware will encrypt the targeted data. All the newly locked files will receive an additional extension appended to their names – '.[bit_decrypt@protonmail.com].BOMBO.' This means that a file that was called 'wind-free.png' initially will be renamed to 'wind-free.png.[bit_decrypt@protonmail.com].BOMBO.'

The Ransom Note

After completing the encryption algorithm, the BOMBO Ransomware will drop a ransom note on the infected computer. The name of the note in question is 'FILES ENCRYPTED.txt.' The BOMBO Ransomware's ransom note is rather brief. In the ransom message, the attackers do not mention what the demanded ransom fee is. However, there is an email address provided – ‘bit_decrypt@protonmail.com.' It is likely that the authors of the BOMBO Ransomware will only disclose the ransom sum after the victim contacts them.

Avoid contacting cybercriminals as they rarely keep their word. If you pay the ransom fee demanded, there is no guarantee that you will be provided with the decryption key you need to restore your files. It is advisable to use a legitimate, trustworthy cybersecurity application to remove the BOMBO Ransomware from your system.