New Ransomware Targets Removable And Attached Drives

There’s a new and unusual ransomware strain making the rounds you should be aware of; it targets removable and attached drives.

This new ransomware has primarily been distributed via ‘malvertising‘ that redirects users to the RIG exploit kit.

One of the most unusual features of this strain is that it specifically doesn’t target the C: drive of the target computer. Instead, this new and unusual ransomware focuses exclusively on drives that are commonly associated with mapped network drives and removable hardware.

BleepingComputer was one of several organizations to discover the ransomware. They all contacted independent security researcher Vitali Kremez to reverse engineer the malware to get a peek under the hood at how it works.

Kremez discovered that this strain only targets the D:, E:, F:, G:, H:, and I: drives. It does not even attempt to encrypt any files located on the C: drive, nor do anything with unmapped network shares.

In addition to that, the AntiFrigus ransomware designs skip any file with the following extensions:

The fact that the ransomware studiously ignores the C: drive and the list of extensions the malware won’t encrypt is curious. It is discerning why the developers would build their code in this way.

Upon review, Kremez concluded that the developers are not sophisticated and are, at this point, still in the experimental stages. The code is still very much a work in progress and may be dangerous. Be sure your staff is aware of this latest threat.