Cylance Ransomware

Cylance is a type of malicious software that operates as ransomware. Its primary objective is to encrypt victims' files to prevent them from accessing their data. Once a file is encrypted, Cylance appends the '.Cylance' extension to the original filename and creates a ransom note named 'CYLANCE_README.txt.'

Cylance ransomware is known to target both Windows and Linux operating systems. The original names of all impacted files will be modified similarly to '1.jpg' to '1.jpg.Cylance,' '2.doc' to '2.doc.Cylance,' and so on. It's worth noting that Cylance ransomware shares the same name as Cylance enterprise cybersecurity, but the latter is an entirely different service that offers customers endpoint security solutions unrelated to ransomware.

The Cybercriminals behind the Cylance Ransomware Extort Victims for Money

The ransom note that victims receive after falling victim to Cylance Ransomware informs them that all their files have been encrypted and are currently inaccessible. The note provides instructions on how to regain access to their data, stating that the attackers are solely interested in profiting from their criminal activity.

To demonstrate their ability to restore the encrypted files, the perpetrators offer to decrypt one file for free. However, the note warns victims against using any third-party software or antivirus solutions, as they could potentially damage the private key and result in data loss.

The ransom note also provides two email addresses - 'crypter@firemail.de' and 'helper@firemail.de,' for victims to contact the threat actors. However, it is highgly advised do not paying the ransom, as you cannot know if the attackers will provide the necessary decryption tools even after receiving payment.

Take Swift Actions if a Ransomware Has Infected Your Devices

In the ocurrence of a ransomware attack, there are some steps that users can take to minimize the potential damage. The first and paramount step is to disconnect the infected device from any networks or external storage devices immediately. This will help prevent the ransomware from spreading to other devices or network resources.

Next, users should use a professional anti-malware tool to scan the device and remove any detected malicious items. Failure to completely clean the breached device could lead to further encryption of data and even bigger problems.

If a backup of the encrypted files is available, users can restore their data from the backup after the infected device has been cleaned. Even if a suitable backup is not available, paying the ransom is definitely not recommended, as there is no guarantee that the cybercriminals will provide the necessary decryption tools even after receiving the money.

In addition to these steps, it's important for users to learn from the attack and take measures to prevent future incidents. This may include implementing stronger security measures, such as updating antivirus software, using firewalls, and regularly backing up important data. It's also important to stay vigilant and educate oneself on the latest ransomware threats and attack methods to better protect against future attacks.

The full ransom note dropped by Cylance Ransomware is:

'[[=== Cylance Ransomware ===]]

[+] What's happened?
All your files are encrypted, and currently unsable, but you need to follow our instructions. otherwise, you cant return your data (NEVER).

[+] What guarantees?
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, we decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. time is much more valuable than money.

[+] How to cantact with us?
Please write an email to: Crypter@firemail.de and Helper@firemail.de
Write this U-ID in the subject: 9cz9eXn9z

Key:

!!! DANGER !!!
DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!'