Microsoft released today a warning about a new ransomware variant called ZCryptor. The new ransomware ZCryptor (ransom zcrypt.a) has the ability to spread like a worm according to the company.
Once it infects a system, it starts copying itself to any removable drive it discovers ahead of it to spread the infection.
Aside from this feature, ZCryptor does not differ much from other ransomware.
Encrypts all files in 88 extensions (Office and archive files, images, audio, video files, log files, database files, APK files, Java, source code files, etc).
Changes their extensions to .zcrypt, and then displays the ransom note (an HTML file that opens with the default browser):
Microsoft says that the ransomware usually arrives via e‑mail as a disguised executable file, or as an Office file macro command.
Immediately after infection it ensures its presence on the infected system and attempts to spread to other systems by creating copies of itself. The malicious software also infects registry entries in order to load on every system startup.
The ransomware then attempts to communicate with a specific URL address from which it receives information and very possibly the key to encrypt the victim's files.
We should mention again that the best protection against ransomware is the regular creation of backups of your important files, which should be stored separately from your main system.
Needless to say, if you have been infected by this ransomware, you should know that any USB stick or other removable drive connected to your system has been infected.
