A new variant of the Cryptomix ransomware has reappeared recently, changing the extension of encrypted files to .tastylock.
Overall, 2017 saw a huge surge in interest in this ransomware as more and more variants emerged. In the new extension, .tastylock, the encryption method remains the same, but a new email address, t_tasty@aol.com., as a payment method for unlocking the files. The next notable change is the extension added to encrypted files. In this version, when a file is encrypted by the ransomware, its existing name is also modified and then given the .tastylock extension. For example, a file encrypted by this variant is given the name 0D0A516824060636C21EC8BC280FEA12.tastylock.
This particular ransomware occasionally appears with new file extensions and troubles security software companies as they have to continuously update their detection and remediation methods. Two very well‑known companies (Malwarebytes and Emsisoft) that deal with its mitigation remind us of the basic protection methods:
- BACKUP is perhaps the most important thing that someone should do regularly on their computer. Clearly, it makes no sense if the backup is done on the disk itself. Your data should be written to an external disk or USB stick which should be disconnected after you finish the process.
- Do not open attached files that you do not know who sent them.
- Do not open attached files if you are not sure the sender is the right one.
- Check the files with an online tool, e.g. (VirusTotal)
- Update your operating system as well as the various programs you use.
- Have security software installed.
- Use difficult passwords, which you will definitely remember, and - if possible - different ones for each site you use.
