STOP - Ransomware is the most active in the Internet but rarely talked about

Have you ever heard of a ransomware called STOP? Perhaps not yet because very few people write about this ransomware, most researchers 'evade' it in reports, and especially STOP mostly targets victims through the crack software, adware packages and shady websites.

No More Ransom - the flagship of the battle against ransomware

STOP - Ransomware is the most active in the Internet but rarely talked about Picture 1 The fight against ransomware is still very tough

The reason ransomware strains such as Ryuk, GandCrab or Sodinkibi have received great attention from cybersecurity organizations because they often require huge ransom payments, can be millions of dollars. , making individuals, businesses and even organizations and government agencies suffer. In addition, when it comes to ransomware, people often pay much attention to the ransomware factor, so the dense coverage of the ransomware mentioned above will also help newspapers and technology news pages to attract a large audience. than.

However, few people know that during 2018 and the first half of 2019, STOP is the most actively distributed ransom encryption software in the internet environment, this result is based on a comprehensive report on the requirements The support request sent to ID Ransomware was analyzed and analyzed by security expert Michael Gillespie at BleepingComputer.

In recent years, STOP ransomware has constantly 'evolved' and become a popular malicious code with a diverse number of variants.

If you still do not believe this is the case, let's take a look at some of the statistics recorded on STOP ransomware. As noted by the ransomware ID ransomware identification service, there are nearly 2500 reports of ransomware being sent to this service center every day, including 60-70% of cases involving ransomware STOP, most are new victims and are seeking help.

GandCrab decoder officially released, ending a bad nightmare called GandCrab Ransomware

STOP - Ransomware is the most active in the Internet but rarely talked about Picture 2 Number of STOP-related cases reported in September

This number completely overwhelms all statistics about other ransomware, regardless of popularity or huge ransom.

STOP - Ransomware is the most active in the Internet but rarely talked about Picture 3 The number of reported STOP ransomware infections is steadily increasing

More attention is being paid to the number of reported ransomware STOP infections which is steadily increasing, completely outperforming other popular ransomware strains, as you can see in the statistics chart above. on.

Application cracks, adware packages and shady websites - STOP's great spreading tools

As mentioned, STOP's distribution method is a bit different from many other ransomware. The people behind the ransomware have chosen to 'cooperate' with websites and adware package providers of unknown origin.

These sites are supposed to promote fake software or free programs, but in reality these are adware packages that can install malware and infect unwanted malware into the system. user's computer system. One of the malicious code installed through these packages is STOP Ransomware itself.

In addition, a number of application cracks are also an effective source of spread of this extortion malware, the most common of which is the crack version of KMSPico, Cubase, Photoshop and a few other common antivirus tools.

[Infographic] 7 effective ways to protect businesses from Ransomware

STOP - Ransomware is the most active in the Internet but rarely talked about Picture 4 Application cracks are also a good source of STOP ransomware

However, not only cracked versions, many shady websites also offer free software download services, and in fact, these are adware packages that can install ransomware on the system of victims. multiply.

Not stopping there, some of these variants silently installed a password-stealing Trojan named Azorult on the victim's computer to steal information about accounts, e-wallets, computer files. desktop . Trojan Azorult is a malicious code that when spread to a victim's computer, it will attempt to steal the username and password information stored in the browser, as well as files on the system. victim's system . then upload the collected data to a remote server under the attacker's control.

It can be said that the factor that makes STOP dangerous and the most active ransomware lies in its flexible spread and its number of variants. Up to now, more than 159 STOP variants have been recorded, and this number is still increasing.

On the other hand, there's not much to say about how STOP works. It still encrypts the victim's file system just like any other ransomware, then appends a specific extension and provides a ransom note.

Even DSLR cameras can easily be attacked by ransomware

The journey to 'rescue' data is becoming more arduous than ever

Security researcher Gillespie has been successful in helping STOP victims recover encrypted files without paying a ransom through its STOPDecryptor decryption tool. This tool includes offline decryption keys that STOP itself uses when unable to communicate with malicious C2 servers.

However, this is not a simple task, with this ransomware sometimes released with 3-4 variants every day, and there are thousands of victims who need help at the same time.

LooCipher ransomware decoder officially launched, helping you get your data completely free

STOP - Ransomware is the most active in the Internet but rarely talked about Picture 5 Ransomware STOP ransom notes

Unfortunately, the encryption has changed and in the near future Gillespie will no longer be able to provide as much support to STOP victims as it did before. This can certainly make many victims of this malware hopeless, especially in case they can not afford to pay the ransom 490 USD, and will double after 72 hours to 980 USD to regain data. has been encrypted. STOP victims are in need of help more than ever.

Many people may think that STOP victims deserve it because they have committed fraud in the first place, using crack software. But paying ransom data to hackers has never been a welcome idea, which only motivates attackers to create more ransomware.

Ransomware is showing signs of booming around the world, and paying is no longer the most viable option.

STOP - Ransomware is the most active in the Internet but rarely talked about Picture 6 STOP victims are in need of help more than ever

The fight against STOP ransomware in particular and other ransomware strains in general is still very difficult and no appointment of an end date.

Lesley Montoya

Update 26 September 2019

You should read it

May be interested

What is Ransomware? How to Protect Your Device from Ransomware
ransomware is becoming one of the biggest threats to internet users. this type of malware can encrypt data and force victims to pay a ransom to recover it. understanding how it works will help you protect your devices from being attacked.
Warning: Babuk Locker Ransomware is Active Again, Attacking the World
after a 3-month hiatus under the name babuk locker, it has returned to creating custom ransomware executables that now target victims around the world.
REvil ransomware gang sites mysteriously stop working ngừng
the revil ransomware infrastructure and websites have been mysteriously down since last night (the night of july 13).
List of the 3 most dangerous and scary Ransomware viruses
while security solutions to protect us from threats, hackers are increasingly improving, while malicious programs (malware) are also becoming more and more 'cunning'. and one of the recent threats is how to extort money through ransomware.
There is a tool to decrypt the ransomware that specializes in attacking businesses
this new ransomware is still in development.
Ransomware can encrypt cloud data
ransomware is as small as a grain of sand, they are everywhere around us. and they can encrypt hard drive attacks but also attack other system drives, and cloud drives don't get out of sight.
GandCrab blackmail extinguished after earning $ 2.5 billion worldwide
after nearly a year and a half of 'storming', the people behind gandcrab ransomware claimed that the malware stopped working and at the same time urged their malicious 'branches' to stop distributing this extortion code. .
General guidelines for decoding ransomware
in this guide, tipsmake.com will try to help unfortunate readers infected with ransomware and encrypted files on the computer.
What is Ransomware Task Force (RTF)?
ransomware has become one of the top security threats in the past three years. the first ransomware strain and one of the worst nightmares in the history of global cybersecurity - wannacry - was discovered in may 2017.
[Infographic] 7 effective ways to protect businesses from Ransomware
how to protect your business from ransomware? join tipsmake.com to follow the article to find the answer.