Demon Ransomware

Cybersecurity experts have identified another potent ransomware threat that could wreak havoc on the devices it infects. The threat is named the Demon Ransomware and analysis of its underlying code points toward it being a variant of the Babuk Ransomware.

The uncrackable encryption routine of the threat allows attackers to lock the data of their victims and then extort them for money. Affected users will lose access to their documents, archives, databases, photos and more. In addition, each encrypted file will have '.demon' appended to its original name. The ransom note of the Demon Ransomware is dropped on the breached systems as a text file named 'How To Recover Your Files.txt.'

Reading the ransom-demanding message reveals that the attackers demand to be paid a ransom of 1.5 BTC (Bitcoin). Even though the Bitcoin cryptocurrency lost a sizeable portion of its value, 1.5 Bitcoins are still worth a massive $30, 000. The money is expected to be transferred to the crypto-wallet address of the cybercriminals. Afterward, victims are told to contact the hackers by messaging their email address at 'demonInfo@protonmail.com.'

Of course, sending any amount of money to cybercriminals should be avoided. The threat actors could simply take the money and run or try to further exploit their victims, causing additional privacy and security concerns.

The full text of the ransom note is:

'Don't worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
Price of private key and decrypt software is 1.5 BTC.
Wallet address: bc1qj4tnmlpas6qpslypk5zve8dmjlj6ljk5jymuju
To get this software you need write on our e-mail: demonInfo@protonmail.com
Reserve e-mail address to contact us: demonInfo@protonmail.com'