Skylock Ransomware

Skylock is a ransomware threat that has been discovered by malware researchers. Once Skylock infects a computer, it changes the filenames of the files by appending the '.skylock' extension to them. For example, '1.jpg' is renamed to '1.jpg.skylock,' and '2.doc' is changed to '2.doc.skylock.' Additionally, Skylock drops a file named 'How_to_back_files.html' on the infected systems. Upon analysis, it has been identified that Skylock is a member of the MedusaLocker Ransomware family.

The 'How_to_back_files.html' file contains a ransom note, which typically demands payment in exchange for a decryption key that can be used to restore the encrypted files. The ransom note usually includes instructions on how to make the payment and obtain the decryption key.

Skylock is a threat that can cause significant damage to an individual or organization by encrypting important files and demanding payment for their release. Take precautions to avoid infection.

Ransomware Threats Like Skylock can Cause Tremendous Damage

According to the ransom note, essential files have been encrypted using RSA and AES encryption, which means that they are unreadable without a decryption key. The note advises against using any third-party software to restore the files, as this could cause permanent damage to them. The hackers claim to have access to highly confidential or personal data, which they threaten to destroy after the ransom is paid. This means that the Skylock Ransomware threat actors are operating a double-extortion scheme to put further pressure on their victims.

If the victim chooses not to pay the ransom, the hackers will make the victim's data public. To negotiate with the hackers, the note contains a link to a Tor site where victims are supposed to contact them and receive instructions on how to pay the ransom and possibly receive the decryption software. The note also warns that the ransom price will increase if the victim does not contact the attackers within 72 hours.

Protecting Your Data from Ransomware Threats is Crucial

To protect their data from being locked by ransomware threats, users need to adopt a comprehensive approach that includes both preventive and reactive measures.

Preventive measures involve implementing security best practices to reduce the likelihood of a ransomware attack occurring in the first place. This includes keeping software up to date, avoiding suspicious emails and attachments, using strong passwords, and being prudent when downloading files from the internet.

Reactive measures are taken after a ransomware attack has occurred and involve restoring data from backups or using decryption tools to regain access to encrypted files. It is critical to have backups of important data stored in a secure location that is not directly connected to the primary system. In addition, users should regularly test their backups to ensure they are working properly.

To prevent attacks, users can also use security software such as anti-malware tools. Get information about the latest ransomware threats and trends, and to educate oneself on how to recognize and respond to suspicious activity.

Overall, protecting one's data from ransomware threats requires a combination of prevention, backup and recovery strategies, and ongoing vigilance.

The full text of the ransom note left by Skylock Ransomware is:

'YOUR PERSONAL ID:

/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!

Your files are safe! Only modified. (RSA+AES)

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.

No software available on internet can help you. We are the only ones able to
solve your problem.

We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..

We only seek money and our goal is not to damage your reputation or prevent
your business from running.

You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.

Contact us for price and get decryption software.

qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Note that this server is available via Tor browser only

Follow the instructions to open the link:

Type the addres "hxxps://www.torproject.org" in your Internet browser. It opens the Tor site.

Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.

Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion

Start a chat and follow the further instructions.
If you can not use the above link, use the email:
ithelp02@decorous.cyou
ithelp02@wholeness.business

To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER'.