R2Block Ransomware

The R2Block Ransomware is a powerful crypto locker that can lock users out of their own computers effectively. The threat uses strong cryptographic algorithms to encrypt a wide range of file types, including the most popular ones such as MS Office documents, PDFs, backups, databases, pictures, audio and video files.

When R2Block encrypts a file, it changes the original filename by appending 'R2Block' as a new extension. The R2Block Ransomware also drops an image file containing instructions from the hackers in every folder with locked data. The same image is then used to substitute the default desktop background on the compromised computer. Furthermore, the threat generates a pop-up window displaying the ransom note.

Looking at the messages delivered by the R2Block Ransomware makes it clear that this particular threat has been designed to target users in Arabic-speaking countries. Indeed, all of the instructions it provides are written in Arabic with no translations to other languages. That doesn't mean that R2Block can't infect users from other countries, though.

When handling the aftermath of a ransomware attack, it is paramount to remember that paying any amount of money is not the best course of action. Not only are there no guarantees that the hackers will keep their end of the deal, but the money they receive can be used to fund their future threatening activities directly.