The only options for victims to recover their files for free are to either have a data backup or look for a third-party decryption tool on the Internet. In general, it is not feasible to decrypt files without the involvement of the cybercriminals responsible for ransomware attacks. However, it is emphasized that failure to respond within three days will result in the files being publicly released. The note also provides contact information and and states that the victim can reach out to discuss possible solutions and obtain the decryptor. The attackers claim that their decryptor is the only program that can restore the files. The note warns the victim not to attempt to decrypt the files on their own or using third-party software, as this will cause irreparable damage to the files. Stolen data includes accounting information, confidential documents, personal data, copies of mailboxes, and database backups. The ransom note indicates that the victim's network has undergone a penetration test during which the attackers have encrypted files and obtained over 250 GB of sensitive data belonging to both the victim and their customers. Screenshot of files encrypted by this ransomware: An example of how Kmufesd modifies filenames: it renames ' 1.jpg' to ' 1.jpg.kmufesd', ' 2.png' to ' 2.png.kmufesd', and so forth. The text file dropped by Kmufesd is a ransom note. kmufesd' extension to filenames, and creates the ' HOW TO RESTORE YOUR FILES.TXT' file. Kmufesd is ransomware that encrypts files, appends the '. Our malware researchers discovered Kmufesd while checking malware samples submitted to the VirusTotal page. After examining Kmufesd, we determined that it is ransomware that belongs to the Snatch family.

Email backup wizard full