SchoolBoys Ransomware

SchoolBoys is a damaging threat created from the leaked LockBit 3.0 builder. In fact, the creators of the SchoolBoys Ransomware have made so few modifications that their ransomware is practically identical to that version of LockBit. However, this doesn't make the threat any less threatening.

Once activated on the breached devices, it will target the victim's files and lock them with an uncrackable cryptographic algorithm. The SchoolBoys Ransomware will create a string of random characters for the specific victims and use it to mark each locked file. The ransom string will be appended to the names of the encrypted files as a new extension. Ransom notes will be delivered via a new desktop background image and a text file named '[random_string].README.txt.'

The ransom note makes it clear that the cybercriminals behind SchoolBoys run a double-extortion scheme and target primarily corporate entities. According to the ransom-demanding message, the threat actors collect confidential data from their victims and threaten to publish it on a dedicated TOR website. To prevent their data from being leaked and to obtain a decryption tool for their files, victims are expected to pay a ransom. To receive instructions on how to make the payment, victims are directed to the TOR website and told to use the login credentials found in the note.

The full text of the ransom note is:

'~SchoolBoys Ransomware Gang~

Your data are stolen and encrypted
The data will be published on TOR website if you do not pay the ransom

Links for Tor Browser:
hxxps://pnanlicgxkku2aonwsg2fwid3maycsso7joqnzp66wkfemzdk7ahsdid.onion
Your personal password for communication:

What guarantees that we will not deceive you?

We are not a politically motivated group and we do not need anything other than your money.

If you pay, we will provide you the programs for decryption and we will delete your data.
Life is too short to be sad. Be not sad, money, it is only paper.

If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future.
Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment.

You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID

Download and install TOR Browser hxxps://www.torproject.org/
Write to a chat and wait for the answer, we will always answer you.

Links for Tor Browser:
hxxps://pnanlicgxkku2aonwsg2fwid3maycsso7joqnzp66wkfemzdk7ahsdid.onion

Your personal DECRYPTION ID:

Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!

Warning! If you do not pay the ransom we will attack your company repeatedly again!

The message delivered as a desktop background is:

LockBit Black

All your important files are stolen and encrypted!
You must find *.README.txt file and follow the instruction!'