Colambia Ransomware

The Colambia Ransomware threat can be used in threatening attacks, as a way to lock the data of chosen targets. The files on the breached devices - documents, PDFs, archives, databases, images, and many more, will be encrypted with a strong cryptographic algorithm, leaving them in an unusable state. Restoration of the data without knowing the specific decryption key in possession of the attackers is typically impossible. Infosec researchers have confirmed that the Colambia Ransomware is a variant of the ZEPPELIN Ransomware threat.

All files affected by the threat also will have their names modified to a significant degree. More specifically, the threat appends '.colambia' to the original names of the processed files, followed by a specially generated ID string. Victims also will notice the appearance of an unfamiliar text file named '!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT' on the desktop of the infected systems.

Inside the file is a ransom note listing the demands of the attackers. The message makes it clear that the attackers are willing to assist with the restoration of the data only after being paid an unspecified ransom. To receive additional instructions, victims are directed towards messaging the two emails of the cybercriminals - 'royroy@cock.li' and 'colambia@tutanota.com,' or contacting them via qTOX chat.

The full ransom-demanding message left by the Colambia Ransomware is:

'!!! ALL YOUR FILES ARE ENCRYPTED !!!

All your files, documents, photos, databases and other important files are encrypted.

You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key.
Only we can give you this key and only we can recover your files.

To be sure we have the decryptor and it works you can send an email: royroy@cock.li and decrypt one file for free.
But this file should be of not valuable!

Do you really want to restore your files?

Write to email: royroy@cock.li
Reserved email: colambia@tutanota.com

Visit hxxps://tox.chat/download.html

Download and install qTOX on your PC.

Open it, click "New Profile" and create profile.

Click "Add friends" button and search our contact - 126E30C4CC9DE90F79D1FA90830FDC2069A2E981ED26B6DC148DA8827FB3D63A1B46CFDEC191

Your personal ID:

Attention!

Do not rename encrypted files.

Do not try to decrypt your data using third party software, it may cause permanent data loss.

Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.'