DARKY LOCK Ransomware
Cybercriminals are using a new threat to lock the data of their victims. It is tracked as the DARKY LOKC Ransomware, is another Babuk Ransomware variant, and its destructive capabilities can affect a wide range of file types including documents, archives, databases, photos, PDFs and more. Like most ransomware operations, the hackers demand to be paid a ransom to assist with the restoration of the locked data.
Users affected by the threat will notice that most of the files stored on the breached device now carry '.darky' as a new file extension. Another change to the system caused by the malware will be the appearance of a text file named 'Restore-My-Files.txt.' The role of the file is to deliver a ransom note with instructions from the threat actors.
Reading the ransom-demanding message reveals that the operators of the DARKY LOCK want to extort the sum of 0.005 BTC, worth around $1000 at the current Bitcoin exchange rate, from their victims. After sending the money to the provided crypto-wallet address, victims are expected to message the 'darkylock@tutanota.com' email address with the details of the transaction.
The full text of the ransom note is:
'---------- Hello -----------
***WELCOME TO DARKY LOCK ***
Your computers and servers are encrypted, and backups are deleted.
We use strong encryption algorithms, so no one has yet been able to decrypt their files without our participation.
The only way to decrypt your files is to purchase a universal decoder from us, which will restore all the encrypted data and your network.
Follow our instructions below, and you will recover all your data:
1) Pay 0.005 bitcoin to 1E6cvG6iEbufvYspsDa3XQ3WJgEMvRTm9i
2) Send us message with transaction id to darkylock@tutanota.com
3) Launch decrypt_bit.exe, which our support will send you through email
What guarantees?
------------------
We value our reputation. If we will not do our work and liabilities, nobody will pay us. This is not in our interests.
All our decryption software is tested by time and will decrypt all your data.
------------------
!!! DO NOT TRY TO RECOVER ANY FILES YOURSELF. WE WILL NOT BE ABLE TO RESTORE THEM!!!'
