A new variant of Cryptomix ransomware has recently appeared, changing the extension of encrypted files to .WORK .
Cryptomix ransomware is a combination of CryptXXX and CryptWall and was first detected in March 2016. It is spread via spam emails and exploit kits such as Nuclear and RIG. It targets over 1200 different file types and uses the AES256 algorithm to lock them.
In the new extension, .WORK, the encryption method remains the same, with the only difference being that new emails are added for the payment method for the files (worknow@keemail.me, worknow@protonmail.com, worknow8@yandex.com, worknow9@yandex.com, and worknow@techie.com).
This ransomware occasionally appears with new file extensions and is a pain for security software companies as they have to constantly update their detection and removal methods. Two well-known companies (Malwarebytes and Emsisoft) that deal with it remind us of the basic protection methods:
- BACKUP is perhaps the most important thing that someone should do regularly on their computer. Clearly, it makes no sense if the backup is done on the disk itself. Your data should be written to an external disk or USB stick which should be disconnected after you finish the process.
- Do not open attached files that you do not know who sent them.
- Do not open attached files if you are not sure the sender is the right one.
- Check the files with an online tool, e.g. (VirusTotal)
- Update your operating system as well as the various programs you use.
- Have security software installed.
- Use difficult passwords, which you will definitely remember, and - if possible - different ones for each site you use.
