Kl Ransomware

Cybercriminals have unleashed another destructive ransomware threat based on the Dharma malware family. Tracked as the Kl Ransomware, the threat is capable of overtaking the infected system by locking nearly all of the files stored on it. Victims will find themselves unable to access their private or business-related files and projects.

As part of the Dharma family, Kl also modifies the names of the files it locks. The threat will first add a string of characters that acts as an identifier for the particular victim. Then, an email address controlled by the hackers (filekiller@onionmail.org, in this case) is appended. Finally, victims will notice that their files have '.kl' as a new extension. When the encryption process has been complete, the Kl Ransomware will drop two ransom notes with instructions for its victims. The primary note will be displayed in a pop-up window, while the second one will be contained inside a text file named 'info.txt.'

Kl Ransomware's Demands

Both notes leave a lot of important details out. The instructions in the text file are extremely rudimentary, simply telling victims to initiate contact by messaging the 'filekiller@onionmail.org' or 'filekiller@msgsafe.io' email addresses. The message in the pop-up window doesn't provide much useful information, either. It mentions the same two emails and concludes with various warnings. For example, the hackers state that any attempt to rename or the use of third-party tools to decrypt the files could cause irreversible damage to the data.

The note in Kl Ransomware's pop-up window is:

'YOUR FILES ARE ENCRYPTED
1024
Don't worry, you can return all your files!
If you want to restore them, write to the mail: filekiller@onionmail.org YOUR ID -
If you have not answered by mail within 12 hours, write to us by another mail:filekiller@msgsafe.io
ATTENTION!
We recommend you contact us directly to avoid overpaying agents
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.'

The message delivered in the text file is:

'all your data has been locked us
'You want to return?
write email filekiller@onionmail.org or filekiller@msgsafe.io'