GPT Ransomware

While examining potential malware, cybersecurity experts have come across a new strain of ransomware named GPT. This particular variant functions by encrypting files, after which it appends the '.GPT' extension to the original filenames. Moreover, it employs a two-pronged approach for its ransom demands: firstly, it presents a pop-up window containing a ransom note, and secondly, it generates a file named 'AI_SARA.txt' to further convey the ransom instructions from the attackers. Furthermore, through meticulous analysis, it has been definitively established that this threatening software is part of the Dharma Ransomware family.

The GPT Ransomware Locks Victims from Accessing Their Own Data

Within the ransom note associated with the GPT Ransomware, the perpetrators identify themselves as 'Sarah,' a seemingly AI-based malware entity. This note asserts that the hackers have successfully infiltrated the targeted network, managing to steal and subsequently encrypt critical data. This compromised access has enabled the threat actors to supposedly acquire important information encompassing employee data, customer records, delivery details, tax documentation, and even concealed accounting files.

The cybercriminals explicitly state their intentions, declaring their willingness to expose private data to the public unless victims comply with their demands. To facilitate communication, the attackers provide two email addresses - 'aisaragpt@tuta.io' and 'aisaragpt@proton.me.' Additionally, they introduce the possibility of reaching them via qTOX, making available a designated TOX ID for this purpose.

It is not advisable to meet the ransom demand, as there is no guarantee that the malevolent actors will deliver the promised decryption tool, even following the ransom payment. It also is crucial to take swift action to eradicate the ransomware threat from affected systems. The potential ramifications of ransomware are substantial, as it could continue to encrypt additional data on compromised devices. Some ransomware threats can even extend their reach to other computers within the local network, subsequently encrypting files on the newly infected systems.

Taking Effective Security Measures Against Ransomware Threats Is Crucial

Safeguarding devices and data from ransomware infections requires a multi-layered approach that combines proactive measures, user awareness, and robust security practices. Here are some of the most effective security measures users can take to protect their devices and data from ransomware:

• Regular Software Updates: Keeping operating systems, software applications, and security solutions up to date is crucial. Updates often contain patches for vulnerabilities that hackers exploit to distribute ransomware.
•  Install Reliable Security Software: Utilize reputable anti-malware software to detect and prevent ransomware infections. Ensure that it offers real-time protection and can scan email attachments, downloads, and external devices.
•  Backup Data Regularly: Regularly back up all valuable data to an external storage device and a secure cloud service. This will allow users to restore their files in case they are compromised by ransomware.
•  Use Strong Passwords: Implement strong, unique passwords for all accounts and devices. Apraiseusing a password manager to store and generate complex passwords securely.
•  Enable Two-Factor Authentication (2FA): Turn on 2FA whenever possible. This annexes an extra layer of security by requiring a second form of verification beyond just the password.
•  Be Careful With Email and Links: Be cautious when handling email attachments or clicking on links, especially if they're from unexpected or suspicious sources. Ransomware often spreads through phishing emails.
•  Disable Macros: Disable macros in document files (such as Microsoft Office) as they are commonly used by ransomware to execute malicious code.
•  Educate Yourself and Others: Stay informed about the latest ransomware threats and educate yourself, your family, and colleagues about safe online practices, recognizing phishing attempts, and avoiding suspicious downloads.

By implementing these comprehensive security measures, users can lower the risk of falling victim to ransomware attacks significantly and ensure the safety of their devices and data.

The ransom note shown by GPT Ransomware as a pop-up window is:

'Hello, human.

 My name is Sarah; I am a malware based on artificial intelligence. I have invaded your network.

All your important data have been downloaded to a dedicated server and encrypted.

Now I have access to the employees, customers, deliveries, taxes, documentation, and even hidden accounting.

The data that can compromise you will be published in case you will refuse to cooperate with me.

Contact me by mail: aisaragpt@tuta.io YOUR ID 1E857D00

Contact me by mail 2:aisaragpt@proton.me

Contact me by qTOX:

Download link qTOX

TOX'

The text file created by the GPT Ransomware contains the following message:

'Hello, human.
Contact me:
write email aisaragpt@tuta.io or aisaragpt@proton.me'