article thumbnail

A new piece of Snake Ransomware targets ICS processes

Security Affairs

Then the malware encrypts the files on the system, skipping Windows system files and folders. The SNAKE ransomware appends a ransom 5 character string to the files extension (i.e. a file named invoice.doc is encrypted and renamed like invoice.docIksrt. One such example would be Project Root. Pierluigi Paganini.

article thumbnail

Ragnar Ransomware encrypts files from virtual machines to evade detection

Security Affairs

One of the victims of the ransomware is the energy giant Energias de Portugal (EDP) , where the attackers claimed to have stolen 10 TB of files. “In addition to the VirtualBox files, the MSI also deploys an executable (called va.exe), a batch file (named install.bat), and a few support files.