Explore our success in recovering various ransomware infections. If you’re facing ransomware issues, submit a ticket for a quick assessment (2-3 minutes). Act promptly – disconnect from the internet to prevent further system damage. Check our <a href=”https://fastdatarecovery.com.au/ransomware-recovery__trashed/how-it-work/” target=”_blank”>How it Works</a> page for guidance or contact us anytime via Email, Chat, or Phone for immediate assistance.

Explore our portfolio highlighting successful recoveries from prevalent ransomware families/variants. If your specific ransomware isn’t listed, please submit a ticket for tailored assistance.

PHOBOS is a ransomware family amending files with various extension such as ACTOR, ACTIN, ADAGE, ADAME, FRENDI, PHOBOS, PHONEIX, MAMBA, WALLET, EKING, EIGHT, DLL, COM, DEVOS, BARAK, BANJO, ETC.
Few new extension are released on weekly basis but the decryption recovery process remains the same
Phobos will amed a file from 1.JPG to 1.jpg.ID-63857777.2140[job2019@tutanota.com].phobos
Phobos is very similar to the Dharma ransomware

Each ID will be a unique infection. Please advise when submitting the ticket if you have multiple IDs.

Please visit our PHOBOS RANSOMWARE for more up to date information

DHARMA  was released in December 2016 approximately and seems to be very profitable for the hackers and continues development until now. We have been successful with 100% guarantee in all Dharma Ransomware variants such as (but not limited to) Harma, Dharma, Wallet, Roger, 1024, BOT, LAO, Lotus, Crypt, Blm, Glb, Arena

Each ID will be a unique infection. Please advise when submitting the ticket if you have multiple IDs.

Please visit our DHARMA RANSOMWARE for more up to date information

MALLOX (aka TargetCompany, Fargo and Tohnichi)

Please visit our MALLOX Ransomware for more up to date information

Hive (also known as the Hunters International) is a RaaS operation carried out by the eponymous cybercrime organization between June 2021 and January 2023. The group’s purpose was to attack mainly public institutions to subsequently demand ransom for release of hijacked data.

November 2023 witnesses the resurgence of the Hive ransomware, signalling the continued presence of its masterminds who have initiated a retaliatory counter-attack.

In January 2023, following a joint US–German investigation involving 13 law enforcement agencies, the United States announced that the FBI had “hacked the hackers” over several months, resulting in seizure of the Hive ransomware group’s servers.

The Hive ransomware group had extorted over $100 million from about 1,500 victims in more than 80 countries when dismantled by law enforcement.

In October 2023, a new ransomware-as-a-service brand named Hunters International has emerged using code used by the Hive ransomware operation, leading to the valid assumption that the old gang has resumed activity under a different flag.

Akira ransomware group is part of the RAPID Ransomware

Please visit our NO_MORE_RANSOM for more up to date information

TargetCompany:

The TargetCompany ransomware was first detected in June 2021, when it was named by industry analysts after the pattern it adopted of appending its encrypted files with the name of the company it was targeting.

In January 2023, threat actors behind TargetCompany clarified that each major update of the ransomware entailed a change in the encryption algorithm and different decryptor characteristics. These are accompanied by a change in file name extensions, hence the evolution of names by which the ransomware group is known. We will discuss this evolution further in our blog entry.  

TargetCompany Ransomware Note:
HOW TO RECOVER !!.TXT, How to decrypt files.txt,

Common TargetCompany Extensions / Variants:

.tohnichi, .artiis, .herrco, .mallox, mallab, .architek, .herrco, .exploit, .carone, .avast, .consultransom, .devicZz, .bozon, .acookies, .bozon3, .FARGO, .Fargo3, .milovski, .brg

TargetCompany Ransomware Attacks:

Top 10 countries targeted by TargetCompany Ransomware Group:

The top 10 countries from a total of 250 detected attack attempts in terms of infected machines for the TargetCompany ransomware (March 2022 – April 2023)
Source: Trend Micro Smart Protection Network

At Fast Data Recovery we can offer 3 types of recovery from TargetCompany Ransomware, this includes

1. Full File Recovery by reversing the decryption key and all files on the affected server will be recovered
2. File Repair Service where we target specific files such as MDF, VHDX, VMDK, ZIP, BAK, QBW and extract the data without reverse engineering
3. Finally Ransomware Negotiation, however we do not endorse this option.

No_More_Ransom is part of the RAPID Ransomware

Please visit our NO_MORE_RANSOM for more up to date information

No_More_Ransom is part of the RAPID Ransomware

Please visit our NO_MORE_RANSOM for more up to date information

No_More_Ransom is part of the RAPID Ransomware

Please visit our NO_MORE_RANSOM for more up to date information

No_More_Ransom is part of the RAPID Ransomware

Please visit our NO_MORE_RANSOM for more up to date information

MR DEC – is part of the Sherminator ransomware family. We are 100% successful in all Mr Dec cases and the average recovery is 48-36 hours

Mr Dec renames all encrypted files by adding a string of random characters to the filenames. For example, “1.jpg” might become “1.jpg.[ID]JrCHOfl83prTYZtyK[ID]“.

It creates the “Decoder.hta” file, which, if executed, locks the screen and displays a ransom message.

GlobeImposter 2.0

GlobeImposter has a long and winding history. First observed in-the-wild in 2016, the name “GlobeImposter” is based on the ransomware’s mimicry of Globe ransomware payloads.

– An active type of ransomware with a successful recovery in 98% of cases

Our research links TZW ransomware (sometimes referred to as LOLNEK or LOLKEK) to the GlopeImposter Ransomware group

GlobeImposter renames your files with a generic extension/variant and drops ransom-demanding messages – “how_to_back_files.html” – are dropped into compromised folders.

GlobeImposter Ransomware Notes:
GlobeImposter renames your files with a generic extension/variant and drops ransom-demanding messages. Some of the common ransomware notes include;

READ_IT.html, !back_files! / HOW_OPEN_FILES.html / HOW_OPEN_FILES.hta,  HOW_OPEN_FILES.hta, how_to_recover_files.html, How_to_back_files.html, #HOW_DECRYPT_FILES#.html, RECOVER-FILES.html, !back_files!.html, !your_files!.html, here_your_files!.html, Read_ME.html, !SOS!.html,  how_to_back_files.html, READ_this_FILE.html, Read_ME.html, !SOS!.html, here_your_files!.html, !back_files!.html, #DECRYPT_FILES#.html, READ_IT.html or !your_files!.html

GlobeImposter Ransomware Common Variants: .crypt, .pizdec, .FIX, .keepcalm, .vdul, .2cXpCihgsVxB3, .medal, .paycyka, .wallet, .3ncrypt3d, .skunk, .BRT92, .HAPP, .707, s1crypt, .au1crypt, .p1crypt, .GOTHAM, .crypt, .rose, .ocean, .Mixi, .725, .726, .help, .sea, .mtk118, .492, .astra, .coded, .txt, .ACTUM, .GRAFF, .JEEP, .BONUM, .GRANNY, .LEGO, .D2550A49BF52DFC23F2C013C5, .rumblegoodboy, .zuzya, .UNLIS, .0402, .Trump, .ReaGAN, .C8B089F, .needdecrypt, .write_on_email, .clinTON, .BUSH, .911, .apk .arena, .crypted!, .DREAM, .suddentax, .Nutella, .emilysupp, .725, .keepcalm, .vdul, .726, .LIN, .wallet, .0.911, .MAKB, .write_me_[email] ,.3ncrypt3d, .needdecrypt, .YAYA, .au1crypt, .needkeys, .zuzya, .BONUM, .NIGGA,..doc, .BRT92,. nWcrypt, .encencenc, .BUSH, .paycyka, .{email@aol.com}BIT, .C8B089F, .pizdec, .[email@cock.li].arena, .CHAK, .pscrypt, .lock, .clinTON, .ReaGAN,. Nutella, .crypt, .rumblegoodboy, .waiting4keys, .FIX, .s1crypt, .FREEMAN, .crypt, .pizdec, .FIX, .keepcalm, .vdul, .2cXpCihgsVxB3, .medal, .paycyka, .wallet, .3ncrypt3d, .skunk, .BRT92, .HAPP, .707, s1crypt, .au1crypt, .p1crypt, .GOTHAM, .crypt, .rose, .ocean, .Mixi, .725, .726, .help, .sea, .mtk118, .492, .astra, .coded, .txt, .ACTUM, .GRAFF, .JEEP, .BONUM, .GRANNY, .LEGO, .D2550A49BF52DFC23F2C013C5, .rumblegoodboy, .zuzya, .UNLIS, .0402, .Trump, .ReaGAN, .C8B089F, .needdecrypt, .write_on_email, .clinTON, .BUSH, .911, .apk .arena, .crypted!, .DREAM, .suddentax, .Nutella, .emilysupp

Email addresses associated with GlobeImposter:
keepcalmpls@india.com, support24@india.com, support24_02@india.com, happydaayz@aol.com, strongman@india.com, file_free@protonmail.com, koreajoin69@tutanota.com, Decoder_master@aol.com, Decoder_master@india.com, legosfilos@aol.com, crazyfoot_granny@aol.com, Ronald_Reagan@derpymail.org, Bill_Clinton@derpymail.org, George_Bush@derpymail.org, paradisecity@cock.li, dream_dealer@aol.com

We are successful in recovering data from GlobeImposter and average recovery is 48-36 hours.

ZEPPELIN appends filenames with a randomized extension, using the hexadecimal numeral system (e.g. “.126-D7C-E67“). For example, “1.jpg” might appear as something similar to “1.jpg.126-D7C-E67“, and so on for all affected files. Additionally, it adds filemarkers (“ZEPPELIN“) to the encrypted files. After this process is finished, a text file called “!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT” is stored on the desktop.

We are 99% successful in recovery from Zeppelin and average recovery is 48-36 hours.

Sodinokibi/Revil –REVIL, also known as Sodinokibi, was a notorious ransomware gang that was active from at least April 2019 until (officially) it was dismantled in January 2022. Leading up to its demise, REvil became one of the most successful and damaging cybercrime syndicates in the world. The group was responsible for some of the most high-profile ransomware attacks in recent history.

In May 2021, REvil was found to behind the attacks on JBS and Colonial Pipeline, which disrupted operations at poultry and pork processing plants across the world and resulted in fuel shortages in the southeastern United States. In July 2021 they targeted Kaseya, a software company that provides IT services to thousands of businesses around the world. The attack impacted an estimated 1,500 companies in total.

Maze – renames all encrypted files by adding a random extension to the filenames. For example, “1.jpg” might become “1.jpg.ILnnD“, and so on. Maze also changes the desktop wallpaper and creates the “DECRYPT-FILES.html” file, a ransom message with instructions about how to decrypt files.

In November 2020, the Maze group claimed they were shutting down operations. However, as is often the case with ransomware groups, they may still be active under a different name.

MAKOP –

The Makop ransomware operators started their infamous criminal business in 2020 leveraging a new variant of the notorious Phobos ransomware. During the last years, the gang maintained a solid presence in the criminal underground even if they did not join the double extortion practice.

Makop renames a file named “1.jpg” would appear as something like “1.jpg.[EF7BE7BC].[makop@airmail.cc].makop“, and so on. After this process is finished, a text file named “readme-warning.txt” or “+README-WARNING+.txt” is created on the desktop.

Some of the common Makop variants we successfully recovered from include but not limited to:
.makop, .mkp, .CARLOS .shootlock shootlock2 .origami .tomas .fair, .read

We are successful in helping our clients recover their data in 48 hours in 95% of cases.

MedusaLocker / Medusa

A ransomware operation known as Medusa has begun to pick up steam in 2023, targeting corporate victims worldwide with million-dollar ransom demands.

The Medusa operation started in June 2021 but had relatively low activity, with few victims. However, in 2023 the ransomware gang increased in activity and launched a ‘Medusa Blog’ used to leak data for victims who refused to pay a ransom.

We are successful in helping our clients recover their data in 24 – 36 hours in 95% of cases.

Meduslocker Ransomware Note: How_to_recovery.txt, How_to_back_files.html,!!!READ_ME_MEDUSA!!!.txt

Meduslocker Ransomware Variants successfully recovered from (not limited to):farattack .itlock .busavelock .deadfiles .filesencrypted .attackuk .attack7 .attacksystem .newlocker .olsavelock31 .itlock20 .alock .meduza24 .locknet .crypto1317, .1btc .mylock .key1, .matlock20, .jpz.nz , .fileslocked, .marlock02, .marlock11, .datalock,.readinstructions ,.cn, .NZ,
.bec, .NET1, .lock, .medusa

Avaddon 

Avaddon is an active ransomware attack and very similar to Revil Ransomare.
The ransom message within the HTML file states that Avaddon encrypts documents, photos, databases and other important files and that it is impossible to decrypt them without software called “Avaddon General Decryptor”. Victims can apparently purchase this decryption tool by following the instructions provided on a Tor website, which contains information such as the cost of the aforementioned decryption tool, how much time victims have to purchase it until the cost is doubled, and various other details

Avaddon drops this file in every folder that contains encrypted files”[random_numbers]-readme.html” file

We have been successful in helping our clients recover from Avaddon ransomware and we offer a no data no charge policy for your peace of mind.

eCh0raix / QNAPCrypt –

Infects mainly vulnerable QNAP NAS drive

The eCh0raix ransomware gang has targeted mainly vulnerable QNAP NAS devices. Recently detected activity suggests that this preferred target has not changed. QNAP NAS are network-attached storage (NAS) systems that can be simply defined as hard drives that constantly connect to the Internet. They are often used as backup hubs by businesses to store vital data essential to business operations. This makes the device built by QNAP a target for ransomware gangs due to the data held on the device.

We are successful in 100% of all eCh0raix / QNAPCrypt cases. Recovery in 48 hours

Snatch

Zeppelin

ZEPPELIN is a malicious program and a variant of Buran ransomware.

During the encryption process, ZEPPELIN appends filenames with a randomized extension, using the hexadecimal numeral system (e.g. “.126-D7C-E67“). For example, “1.jpg” might appear as something similar to “1.jpg.126-D7C-E67“, and so on for all affected files. Additionally, it adds filmmakers (“ZEPPELIN“) to the encrypted files. After this process is finished, a text file called “!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT” is stored on the desktop.

We are successful in recovering most cases of Zeppelin ransomware with a no data no charge gurantee.

Please note: This page is under ongoing updates to provide you with the latest information.

Ransomware Recovery Procedures

Fast Data Recovery proudly stands as the industry leader in ransomware recovery and cybersecurity services, offering round-the-clock assistance with our dedicated ransomware recovery team.

Our corporate headquarters is strategically situated in Sydney, Australia, and we operate with a global team of 12 highly skilled engineers, spanning across Australia, the United States, United Kingdom, Europe and the Philippines.

We bring a wealth of resources, knowledge, and extensive experience to bear on the task of not only removing ransomware threats but also ensuring your organization is fortified against future attacks.

At Fast Data Recovery, we recognize the paramount importance of your data and, as such, we spare no effort in swiftly and effectively restoring your critical business information.

Key Highlights of Our Ransomware Data Recovery Service:

• Swift Turnaround: Our commitment to expeditious ransomware data recovery ensures minimal disruption to your operations.
• Global Recovery: With our team of 12 highly skilled engineers and unwavering commitment to rapid ransomware data recovery, we offer 24/7 support to minimize disruptions to your operations.
• Guaranteed Recovery: We stand behind a 100% guaranteed recovery promise, assuring you that your data is in the most capable hands.
• No Data, No Charge Policy: For your complete peace of mind, our “No data = No charge” policy underscores our dedication to results.

To learn more about our meticulous process for ransomware  analysis and to receive a customized quote for recovery, we invite you to explore our “How it works?” page or simply call and/or chat with our engineers for immediate assistance.

CONTACT US

Fast Data Recovery supports clients worldwide.

We are available 24/7 for all your enquiries.

You can contact us via email, our online chat, or if you prefer to talk to a ransomware recovery engineer, feel free to call us on one of the numbers below:

1300 500 400 (Australia)

• Discover why Fast Data Recovery is your ultimate partner when it comes to combating ransomware and safeguarding your critical data:

  1. 100% Guaranteed Recovery: We stand by our promise of recovering your data from most ransomware types, providing you with peace of mind.

  2. Round-the-Clock Technicians: Our dedicated team is available 24/7, ready to initiate your recovery promptly, minimizing downtime.

  3. Priority Data Recovery: In 90% of cases, we achieve a swift 48-hour recovery turnaround, ensuring you get back to business faster.

  4. Australian-Based with Global Support: Our roots in Australia are fortified by 24/7 worldwide support, extending our reach to assist clients wherever they may be.

  5. Free or Priority Evaluation: Choose between a free evaluation or a prioritized 4-24 hours evaluation for urgent cases, with most evaluations completed within 4-8 hours.

  6. No Obligation Fixed Quotes: Transparency is our hallmark; you receive fixed quotes with no obligation.

  7. No Data, No Charge: Your satisfaction is guaranteed with our “No Data, No Charge” policy, assuring you of results.

  8. Remote Recovery: Say goodbye to the hassles of sending us your data; all recoveries are performed remotely for your convenience.

  9. Ransomware Specialists: Our expertise extends beyond recovery; we provide advanced ransomware prevention and security services to eliminate future risks.

  10. Established Expertise: With over a decade of data recovery experience, you’re in the hands of seasoned professionals.

  11. Thousands of Happy Clients: Join our extensive list of satisfied clients who have experienced our exceptional services.

  12. International Clients Welcome: We extend our services globally, ensuring that clients worldwide benefit from our expertise.

  Fast Data Recovery is more than just a solution; we’re your reliable partner in the fight against ransomware. Contact us today to experience the difference.

We strongly discourage paying a ransom to cybercriminals as the chances of successfully recovering your files are slim.

In some cases, when you attempt to negotiate with hackers and fail to meet their ransom demands, they may retaliate by exposing sensitive information about your organization to the public. It is advisable to refrain from any communication with them. Please note that using an alternate email does not guarantee your anonymity, as each infection is typically associated with a unique identifier linked to your organization.

Based on feedback from customers who paid the ransom without seeking assistance from a ransomware recovery company or attempting to negotiate, several scenarios have emerged:

1. The hackers might demand additional payments after you’ve made the initial one (a recurring trend).
2. The hacker’s email address is often shut down by the email service provider, as these addresses are reported to domain webmasters. This is especially likely to occur given that numerous victims are affected simultaneously.
3. Hackers may provide you with a sample file, take your payment, and then cease communication.
4. In some cases, the hackers may indeed restore some or all of your files, but there is no guarantee.

If you or your organization is dealing with a ransomware incident, it’s important to consult with our experienced team so we can help assess your specific situation and advise on the best course of action. The decision on whether to pay a ransom, negotiate, or seek alternative recovery methods should be made carefully, taking into consideration the potential risks and consequences.

In 90% of cases we will be able to recover our data without the need to deal with the treat actors.

For a risk-free recovery, Submit an online case or talk to our ransomware specialist to assist with your Ransomware recovery

Get A Quote NowGet A Quote Now

Upon discovering that your system has been compromised by a Ransomware, it is imperative to take immediate action.

Here are the recommended steps:

1. Isolate the Infected System: Disconnect the infected system from your network. Do not shut it down, as doing so could potentially worsen the situation and result in further damage.
2. Avoid DIY Removal: Resist the urge to attempt ransomware removal using antivirus software or other tools, as this could exacerbate the damage to your files.
3. Seek Professional Assistance: Reach out to our dedicated Ransomware expert. Our specialist will assess the situation comprehensively and provide you with the most effective and secure course of action.

“Knowledge Empowers – Defend Yourself Against Ransomware Threats”

Understanding the Compromise:

1. Intrusion Path: Ransomware gains a foothold in a system through security weaknesses. Knowing how your system was compromised is vital.
2. Bot Scans: Cybercriminals employ automated scans, known as bots, to search the internet for vulnerable network systems. Once they identify a vulnerable system, they move in to exploit its security.

The Chain of Compromise: 3. Sale of Vulnerabilities: Hackers often sell lists of compromised systems through underground websites.

4. System Infection: These lists are purchased by ransomware attackers who use the acquired details to compromise and infect systems.
5. Shared Vulnerabilities: It’s important to note that these lists may be sold to multiple hackers, increasing the risk.

Isolation Alone Isn’t Enough:

6. Partial Solution: Isolating an infected system from your network is a common response, but it’s only half the solution.

7. Clever Distribution: Hackers use group policies to distribute ransomware across your network, often eluding antivirus and malware software.
8. Persistent Threats: Ransomware may include time bombs, backdoors, and keyloggers, which enable hackers to maintain access, especially if a ransom is paid.

Future Threats Loom:

9. Imminent Risk: Once you’ve been infected, the likelihood of subsequent attacks increases significantly.

1. Preventive Measures: We strongly recommend a comprehensive security audit on your network to pinpoint vulnerabilities and ensure robust safeguards before proceeding with data recovery.

Our Comprehensive Approach: 11. Simultaneous Action: Fast Data Recovery offers both ransomware prevention and recovery services in parallel. This approach ensures your files are recovered on a ransomware-free system without causing unnecessary delays. Our prevention and recovery teams work hand in hand.

Ready to Defend Against Ransomware? Inquire about our Ransomware Prevention and Security Audit

Get A Quote NowGet A Quote Now