Just Ransomware

Computers infected with the Just Ransomware threat will be subjected to data encryption. Victims risk losing access to most of the files stored on the devices. Files, such as documents, images, archives, PDFs, databases and many others will be rendered inaccessible via a strong encryption algorithm. The ode and behavior exhibited by the Just Ransomware confirm that it is a variant belonging to the threatening Dharma family.

The files impacted by the threat will have '.just' appended to their names as a new file extension. In addition, the ransomware also will add an ID string created specifically for each victim and an email address ('justdoit.onionmail.org') to the names of the locked files. The operators of the Just Ransomware deliver two ransom notes with instructions.

The shorter of the two ransom-demanding messages will be dropped onto the breached devices as a text file named 'FILES NECRYPTED.txt.' It tells victims that to get their data back, they must contact the attackers by messaging either the 'justdoit@onionmail.org' or 'justdoit@msgsafe.io' email addresses. The main ransom note will be displayed as a pop-up window. However, it contains few useful details and mostly reiterates the instructions for messaging the threat actors.

The full text of Just Ransomware's pop-up window is:

'YOUR FILES ARE ENCRYPTED
Don't worry,you can return all your files!
If you want to restore them, follow this link:email justdoit@onionmail.org YOUR ID -
If you have not been answered via the link within 12 hours, write to us by e-mail:justdoit@msgsafe.io
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.'

The ransom note delivered as a text file is:

'all your data has been locked us
You want to return?
write email justdoit@onionmail.org or justdoit@msgsafe.io'