Orkf Ransomware

The Orkf Ransomware is a variant belonging to the infamous STOP/Djvu malware family. Despite lacking any meaningful modifications or improvements when compared to the other threats from the family, Orkf's threatening capabilities are extremely harmful. If the threat manages to infect a targeted computer successfully, it will lock nearly all of the files stored there with an uncrackable cryptographic algorithm.

In essence, the threat will take the locked data as a hostage and then extort its victims for money by promising to provide them with the decryption key needed to restore the files. Affected users will notice that each encrypted file will have '.orkf' appended to its name as a new extension. At the same time, a ransom note will be dropped on the compromised system. The message from the cybercriminals will be contained inside a text file named '_readme.txt.'

Ransom Note Overview

The ransom note delivered by the threat follows the typical STOP/Djvu format. It states that victims must pay a ransom of $980 but if they initiate contact in the first 72 hours of the malware attack, the demanded sum will be decreased by 50% to $490. To reach the hackers, affected users are told to send a message to the 'manager@mailtemp.ch' and 'managerhelper@airmail.cc' email addresses. A single locked file can be attached to the message. The Orkf Ransomware hackers will then supposedly decrypt it and return it to the user.

The full text of the note is:

'ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted
with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-ykQaS2tRyB
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
manager@mailtemp.ch

Reserve e-mail address to contact us:
managerhelper@airmail.cc

Your personal ID:'