Mztu Ransomware

The purpose of the Mztu Ransomware threat is to encrypt the files found on breached computers and devices. The Ntzu Ransomware scans for a wide range of different file types, encrypts them with a strong cryptographic algorithm, and appends their filenames with the '.mztu' extension. Once its main function has been completed, the Mztu Ransomware will create a "_readme.txt" text file on the victim's system. The file contains a ransom note listing the demands of the threat actors. Mztu is another ransomware variant belonging to the STOP/Djvu family. This is an important fact because threat actors spreading the STOP/Djvu malware sometimes also collect sensitive data using threatening stealers like RedLine and Vidar before encrypting files with their chosen ransomware.

Mztu Ransomware’s Demands

The Mztu Ransomware is a devious threat that encrypts files on a victim's computer and demands payment for the decryption key and software. Victims are urged to contact the threat actors within 72 hours to pay only $490 instead of the full sum of the ransom, which is $980. In most of the cases, it is impossible to decrypt the affected files without these tools. The attackers provide two email addresses - 'support@freshmail.top' and 'datarestorehelp@airmail.cc' - where victims can contact them and send one encrypted file for free decryption.

Stopping Attacks from Mztu and Other Ransomware

Ransomware attacks can be extremely disruptive and quite costly, no matter if the victim is an individual user or a major organization. To help protect against ransomware infections, you can implement several essential measures.

1. Install Security Updates Regularly

Having up-to-date software is key when it comes to stopping ransomware attacks – so make sure you're installing security patches as soon as they become available – not just on servers but also on endpoint devices, such as laptops, desktops and mobile devices used at work or at home. If possible, set up automated updates so that you don't have to remember to manually update each device every time a patch is released.

2. Back Up Your Data Regularly

Regular backups should form part of any good ransomware response plan since they allow you to restore data quickly following an attack without having to negotiate with attackers over the payment of any ransom amounts or relying on them sending decryption keys that may not unlock your data anyway. You must implement periodic backups for all important data stored on local drives, shared storage systems, and cloud storage services so you don't lose anything valuable in case of a cyberattack.

3. Monitor Network Activities

Organizations also should set up processes for monitoring network traffic flows. This will allow them to keep track of any patterns that look suspicious or out of character compared with normal operations within the environment. Essentially, enabling identifying threats early before they could have had the chance to do any damage. Installing network monitoring solutions allows organizations to create dashboards where staff can view network activities easily and monitor trends over time, which helps detect anomalous behavior than could indicate a compromise attempt in progress.

The full text of Mztu Ransomware's ransom note is:

'ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-cud8EGMtyB
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshmail.top

Reserve e-mail address to contact us:
datarestorehelp@airmail.cc

Your personal ID:'

Mztu Ransomware Video

Tip: Turn your sound ON and watch the video in Full Screen mode.