Zenya Ransomware

Cybersecurity experts are warning about a new Xorist Ransomware variant tracked as the Zenya Ransomware. Despite being another variant of the infamous Xorist Ransomware, Zenya has retained the destructive capabilities of this malware family and it can lock the victims out from accessing their documents, archives, databases, PDFs, photos, etc. Typically, ransomware operators are financially motivated and their goal is to extort money from the impacted users or corporate entities.

The Zenya Ransomware modifies the names of the files it encrypts by appending a new file extension ('.ZeNyA') to them. When all targeted file types have been processed, the threat will drop a text file named 'HOW TO DECRYPT FILES.txt' containing a ransom-demanding message. However, the main ransom note will be delivered to users in a new pop-up window.

Cybercriminals commonly state that they will accept only payments made using a chosen cryptocurrency. Some also may promise to decrypt a couple of small and unimportant files for free as they may be exposing themselves to additional security or privacy risks.