Jhdd Ransomware

The Jhdd Ransomware is a threat for the sole purpose of locking the data of its victims and leaving it in an unusable state. The threat is capable of impacting numerous different file types including PDFs, documents, archives, databases, pictures, audio and video. The goal of the attackers is to leverage the encrypted data to extort money from their victims. It should be noted that analysis of Jhdd has revealed that the threat is a variant from the STOP/Djvu family. The main characteristic that sets this variant from the rest is the '.jhdd' file extension it uses to mark each locked file. A ransom note will be created on the breached devices in the form of a text file named '_readme.txt.'

Ransom Note's Overview

The instructions left by operators of the Jhdd Ransomware follow the typical pattern observed in STOP/Djvu Ransomware threats. The note states that victims must pay the sum of $980 if they want to receive the decryption software and unique key needed for the restoration of their files from the cybercriminals. According to the note, affected users who establish contact within the first 72 hours will receive a preferential offer of having to pay 50% less.

The cybercriminals responsible for spreading the Jhdd Ransowmare also claim to be willing to decrypt 1 file for free. Typically, ransomware operators use this as an opportunity to demonstrate their ability to restore all of the encrypted data. Victims are given three methods to contact the hackers - a primary email at 'restorealldata@firemail.cc,' a secondary address at 'gorentos@bitmessage.ch,' and a '@datarestore' Telegram account.

The full text of the ransom note is:

'ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-WbgTMF1Jmw
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
restorealldata@firemail.cc

Reserve e-mail address to contact us:
gorentos@bitmessage.ch

Our Telegram account:
@datarestore

Your personal ID:'