Raldug Ransomware

The Raldug Ransomware was reported on April 9th, 2019. The Raldug Ransomware
is a variant of the STOP Ransomware. The Raldug Ransomware is classified as a slightly altered copy of the original Trojan that may be delivered to PC users via spam emails and password-protected archive files. Once, the Raldug Ransomware enters a system it may use process names related to Java, Adobe Flash Player, and Windows Update to hide its activity. The Raldug Ransomware enciphers data across connected SSD and HDD memory storage. The Trojan marks the encrypted files by adding the '.raldug' extension, which is where its name comes from. For example, 'Aluminé Lake.png' is renamed to 'Aluminé Lake.png.raldug' and it can't be loaded in any image viewer until it is decrypted. The Ransomware actors may offer the users a decryptor in exchange for $980 that is to be paid via Bitcoin. The ransom message is enclosed in '_readme.txt,' which may be loaded by the Trojan in Notepad automatically. The ransom note associated with the Raldug Ransomware is listed below:

'ATTENTION!
Don't worry my friend, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-1LFQOfI0Se
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" folder if you don't get answer more than 6 hours.

Your personal ID:
[random characters]'

The text used by the Raldug Ransomware is the same one used across other variants. Even the emails — 'blower@india.com' and 'blower@firemail.cc' have been recorded earlier. Unfortunately, some email providers are not cooperative and may enable the threat actors to continue using their services and extort money from PC users. Experts counsel users to avoid negotiations with the Raldug Ransomware and choose to recover data via a backup manager. It is safer to boot data backups and use cloud services than to trust the cybercriminals behind the Raldug Ransomware.