Remove Backups Remove Consumer Services Remove Encryption Remove VPN
article thumbnail

Evolution of JSWorm ransomware

SecureList

Several versions were released as part of each “rebranded” variant that altered different aspects of the code, renamed file extensions, cryptographic schemes and encryption keys. In addition, it deletes all system backups, shadow copies, disables the system recovery mode, and clears event logs. Encryption flaws.

article thumbnail

Ransomware world in 2021: who, how and why

SecureList

To ensure that their ability to restore encrypted files would never be questioned, they cultivated an online presence, wrote press releases and generally made sure their name would be known to all potential victims. The malware sample has an encrypted configuration block with many fields, which allow attackers to fine-tune the payload.