'.micro File Extension' Ransomware

The '.micro File Extension' Ransomware is a recently released variant of TeslaCrypt, a well-known ransomware threat that has been especially active since the first months of 2015. TeslaCrypt is currently in its version 3.0, which has made the attack stronger and more resilient to removal. The release of this new version of TeslaCrypt has coincided with the release of numerous variants of this threat, one of which is the '.micro File Extension' Ransomware. These different variants are essentially the same threat, but using different file extensions and changing slight details to the attack. The main 'new' feature in the '.micro File Extension' Ransomware and its many variants is the closing of a weakness in the threats that allowed PC security researchers to recover the decryption key from the affected computer. Unfortunately, an infection by the '.micro File Extension' Ransomware, like any other advanced ransomware, is nearly impossible to recover from, requiring computer users to restore their encrypted files from a backup location. Prevention is the best measure against ransomware like the '.micro File Extension' Ransomware and the many TeslaCrypt variants currently active.

How the '.micro File Extension' Ransomware may Attack Your Computer

Ransomware like the '.micro File Extension' Ransomware works by encrypting the victim's files using AES encryption. Once the files have been encrypted by the '.micro File Extension' Ransomware, they cannot be recovered without the decryption key. The way that the '.micro File Extension' Ransomware makes its money is by holding the files hostage, and offering a decryption key in exchange for the ransom amount. The main reason the '.micro File Extension' Ransomware (and their variants) attacks have increased substantially in the recent year is the rise of the RaaS (Ransomware as a Service) industry, where the people responsible for TeslaCrypt or other ransomware variant offer their threats to clients who may customize it to carry out their attacks, getting a percentage of the ransom as a payment. The '.micro File Extension' Ransomware is one of the many TeslaCrypt variants created in this way. The '.micro File Extension' Ransomware attack is quite simple and similar to other ransomware attacks. The following are the steps that may be involved in these types of infections:

1. The '.micro File Extension' Ransomware may be distributed using typical threat delivery methods such as attack websites and corrupted email attachments. In the case of the '.micro File Extension' Ransomware, this threat may be delivered using targeted phishing email messages with threatening attachments in the form of infected PDF or DOC files.
2. Once the '.micro File Extension' Ransomware has been downloaded and executed, it scans the victim's hard drives, looking for files with extensions contained in its configuration file. The '.micro File Extension' Ransomware looks for media files, documents, pictures, game saves, and similar files that are difficult to recover. By only targeting these specific files, the '.micro File Extension' Ransomware can encrypt critical content on the victim's computer, but the PC remains functional.
3. Using its encryption algorithm, the '.micro File Extension' Ransomware encrypts all the files it finds, sending the decryption key to its Command and Control server. The decryption key is not on the affected computer, making it impossible to obtain it from the '.micro File Extension' Ransomware infection. As part of its attack, the '.micro File Extension' Ransomware deletes shadow copies and System Restore points, making it impossible to recover the infected files using these types of methods.
4. The '.micro File Extension' Ransomware demands its ransom by dropping HTML and text files in directories where the encrypted files are located. The '.micro File Extension' Ransomware will also display pop-up messages and change the infected computer's Desktop picture to a ransom note. A typical ransom note associated with the '.micro File Extension' Ransomware and other TeslaCrypt variants reads as follows:

Your personal files are encrypted!
Your files have been safely encrypted on this PC: photos, videos, documents, etc. Click "Show Encrypted Files" button to view a complete list on encrypted files, and you can personally verify this.
Encryption was produced using a unique public key RSA-2048 generated for this computer. To decrypt files you need to obtain the private key.