OFFICIAL SITE OF THE STATE OF NEW JERSEY

	File a Cyber Incident Report \| File a Data Breach Report
	Member Portal Login

Ransomware

The list provided below is meant to provide an overview of the most prevalent ransomware variants currently impacting US victims. This page is updated regularly with new information as it becomes available.

A

AES-NI

AES-NI, also known as AES and AES256, targets Windows OS.

LEARN MORE +

Alfa

Alfa, a new variant from the creators of Cerber, targets Windows OS and the method of distribution is currently unknown.

LEARN MORE +

Alma Locker

Alma Locker targets Windows OS and is distributed via the RIG exploit kit.

LEARN MORE +

Ako

LEARN MORE +

Alpha

Alpha targets Windows OS and, currently, the method of distribution is unknown.

LEARN MORE +

Alpha Crypt

Alpha Crypt targets all versions of the Windows OS and spreads via the Angler exploit kit.

LEARN MORE +

Amnesia

Amnesia targets Windows OS and is distributed via Remote Desktop Protocol (RDP) compromise conducted through brute force attacks.

LEARN MORE +

AnonPop

AnonPop is malware designed to look like ransomware, claiming to encrypt files and demanding a ransom payment from the victim.

LEARN MORE +

AnteFrigus

LEARN MORE +

Anubi

Anubi targets Windows OS and its distribution method is currently unknown.

LEARN MORE +

Apocalypse

Apocalypse targets Windows OS and the method of distribution is currently unknown.

LEARN MORE +

APT Ransomware v2.0

APT Ransomware v2.0 targets Windows OS and is distributed via third-party toolbars, free software, files downloaded through P2P networks and torrents, and spam emails containing malicious links and attachments.

LEARN MORE +

Aurora/Zorro

First detected in the summer of 2018, this ransomware was initially branded as Aurora but has been referred to as Zorro in recent attacks.

LEARN MORE +

AutoLocky

AutoLocky targets Windows OS and, currently, the method of distribution is unknown.

LEARN MORE +

B

BadBlock

BadBlock targets Windows OS and is distributed via websites containing malicious Javascript or exploit kits delivering fake Adobe Flash Player updates, as well as through malicious email attachments.

LEARN MORE +

Bad Rabbit

On October 24, 2017, Bad Rabbit was discovered impacting Eastern European government agencies and private businesses

LEARN MORE +

Bandarchor

Bandarchor targets Windows OS and is distributed via the Neutrino exploit kit and through malicious email attachments.

LEARN MORE +

Bart

Bart targets Windows OS and is distributed via email attachments containing JavaScript that, when opened, installs RockLoader, a malware dropper that attackers have also used to infect victims with Locky and Dridex.

LEARN MORE +

BitKangoroo

BitKangoroo targets Windows OS and the distribution method is unknown as this variant is currently in development.

LEARN MORE +

Bit Paymer

Bit Paymer, sometimes written as BitPaymer, targets Windows OS and is distributed via RDP compromise.

LEARN MORE +

BitStak

BitStak targets Windows OS and the method of distribution is currently unknown.

LEARN MORE +

Black Ruby

Black Ruby, detected by MalwareHunterTeam, targets Windows OS, scrambles file names and appends .BlackRuby to the names of encrypted files.

LEARN MORE +

Black Shades

Black Shades targets Windows OS and, although the current distribution method has not yet been verified, it is believed to be distributed as fake videos, cracks, and patches.

LEARN MORE +

BTCWare

BTCWare, also known as CrptXXX and CryptoByte, targets Windows OS and is distributed manually via Remote Desktop Protocol (RDP) compromise.

LEARN MORE +

Bucbi

Bucbi, a ransomware family that was first released in 2014, has recently been seen in circulation again.

LEARN MORE +

Buran-Zeppelin

Buran ransomware, also known as Vega, VegaLocker, and Jamper, was first observed in May 2019 by McAfee researchers in a Russian-speaking forum and offered as ransomware-as-a-service (RaaS).

LEARN MORE +

C

Cerber

Cerber targets Windows OS and is distributed via malvertising delivered by the Nuclear Exploit Kit.

LEARN MORE +

Chimera

Chimera targets Windows OS and spreads via spear-phishing emails containing a link to a URL or a Dropbox file that hosts malicious downloads.

LEARN MORE +

CHIP

CHIP targets Windows OS and is distributed via the RIG-E exploit kit on compromised websites.

LEARN MORE +

CoinVault

CoinVault is part of the CryptoGraphic Locker ransomware family and targets Windows OS.

LEARN MORE +

Comrade Circle

Comrade Circle targets Windows OS and is distributed via phishing emails containing Word documents embedded with a malicious macro.

LEARN MORE +

Conti

Conti is a ransomware variant that targets systems via malicious emails and additionally threatens data exposure if ransom is not paid. The threat group behind the variant are suspected to be related to the Ryuk operators.

LEARN MORE +

Coverton

Coverton targets Windows OS and, currently, the method of distribution is unknown.

LEARN MORE +

CradleCore

CradleCore, also known as Cradle Ransomware, is a Ransomware-as-a-Service (RaaS) kit currently being sold as source code on the Dark Web for a starting price of 0.35 Bitcoin.

LEARN MORE +

CryLocker

CryLocker, also known as Central Security Treatment Organization (CSTO) or Cry Ransomware, targets Windows OS and it is distributed via the Sundown exploit kit.

LEARN MORE +

CrypBoss

CrypBoss is a family of ransomware that includes the HydraCrypt and UmbreCrypt variants.

LEARN MORE +

CrypMIC

CrypMIC targets Windows OS and is distributed via the Neutrino exploit kit.

LEARN MORE +

Crypren

Crypren targets both Windows OS and Linux distributions based on Debian and spreads via phishing emails and infected PDF, DOC, and ZIP files.

LEARN MORE +

CryptFile2/CryptoMix

CryptFile2/CryptoMix targets Windows OS and is distributed via the Nuclear and Neutrino exploit kits.

LEARN MORE +

CryptMix

CryptMix, a combination of CryptXXX and CryptoWall, targets Windows OS and is distributed via phishing emails and drive-by downloads.

LEARN MORE +

CryptoBit

CryptoBit targets Windows OS and is distributed via the Rig exploit kit.

LEARN MORE +

CryptoHost

CryptoHost targets Windows OS and is currently distributed through a compromised uTorrent installer.

LEARN MORE +

CryptoJoker

CryptoJoker targets Windows OS and spreads via spam and phishing campaigns.

LEARN MORE +

CryptoLuck

CryptoLuck targets Windows OS and is distributed via the RIG exploit kit through malvertising.

LEARN MORE +

CryptON

CryptON, also known as Nemesis or X3M, targets servers running Windows OS and is distributed and executed manually via Remote Desktop Protocol (RDP) brute force attacks.

LEARN MORE +

Crypton

Crypton targets Windows OS and is distributed via a generic malware dropper.

LEARN MORE +

CryptoRoger

CryptoRoger targets Windows OS and the method of distribution is currently unknown.

LEARN MORE +

CryptoShield 1.0

CryptoShield 1.0, a variant of CryptFile2/CryptoMix, targets Windows OS and is currently being distributed via the EITest malware campaign and the RIG exploit kit.

LEARN MORE +

CryptoWall

CryptoWall, a successor to the now-defunct CryptoLocker, targets Windows OS and spreads via spam, drive-by downloads, malvertising campaigns, and exploit kits such as Nuclear and Angler.

LEARN MORE +

CryptoWire

CryptoWire targets Windows OS and is currently being distributed via GitHub as an open-source “advanced proof of concept” ransomware variant.

LEARN MORE +

CryptXXX

CryptXXX targets Windows OS and is distributed through the Bedep Trojan spread via the Angler Exploit Kit.

LEARN MORE +

CryPy

CryPy targets Windows OS and its method of distribution is currently unknown.

LEARN MORE +

CrySiS/Dharma

CrySiS/Dharma targets Windows OS and is distributed as malicious attachments in spam emails and disguised as installation files for legitimate software.

LEARN MORE +

CTB-Faker

CTB-Faker pretends to be the CTB-Locker ransomware variant and targets Windows OS.

LEARN MORE +

CTB-Locker

CTB-Locker (Curve-Tor-Bitcoin-Locker), also known as Critroni, was the first crypto-ransomware to use the Tor network for C2.

LEARN MORE +

CuteRansomware

CuteRansomware targets Windows OS and is based on source code from a publically available ransomware module called “my-Little-Ransomware,” posted on the open-source Git repository, GitHub.

LEARN MORE +

D

Data Keeper

Data Keeper, available on the dark web as a Ransomware-as-a-Service (RaaS), encrypts files using a dual AES and RSA-4096 algorithm.

LEARN MORE +

DecryptorMax

DecryptorMax, also known as CryptInfinite, targets Windows OS and spreads via malicious Word documents masquerading as resumes in spam emails.

LEARN MORE +

Ded Cryptor

Ded Cryptor targets both English-speaking and Russian-speaking Windows OS users and the method of distribution is currently unknown.

LEARN MORE +

Defray

Defray targets Windows OS and is distributed via emails containing malicious Microsoft Word attachments.

LEARN MORE +

DeriaLock

DeriaLock targets Windows OS but requires the .NET Framework 4.5 for installation and, therefore, it does not affect systems running Windows XP. Its distribution method is currently unknown.

LEARN MORE +

desuCrypt

DesuCrypt is an open-source ransomware project from which a new ransomware family has been created.

LEARN MORE +

DetoxCrypto

DetoxCrypto targets Windows OS and is distributed as an executable file that contains other files and executables.

LEARN MORE +

Djvu/STOP

The Djvu/STOP ransomware, which appears to be a variant of the STOP ransomware, first appeared in December 2018.

LEARN MORE +

DMA Locker

DMA Locker targets Windows OS and one known method of distribution is through Remote Desktop.

LEARN MORE +

Dogspectus

Dogspectus, also known as Cyber.Police, targets Android OS and spreads via a currently unnamed exploit kit.

LEARN MORE +

Domino

Domino targets Windows OS, it is based on Hidden Tear, and its current method of distribution is unknown.

LEARN MORE +

DoubleLocker

DoubleLocker targets Android OS, masquerades as a Flash Player app, and shares similarities with the Svpeng trojan.

LEARN MORE +

DXXD

DXXD targets Windows servers and the method of distribution is currently unknown.

LEARN MORE +

DynA-Crypt

DynA-Crypt targets Windows OS and its method of distribution is currently unknown.

LEARN MORE +

E

eCh0raix

eCh0raix, also dubbed QNAPCrypt by Intezer researchers, is a new ransomware variant that has been observed targeting the Linux-based Quality Network Appliance Provider, Network Attached Storage (QNAP NAS) devices used for file storage and backups.

LEARN MORE +

EduCrypt

EduCrypt targets Windows OS and the method of distribution is currently unknown.

LEARN MORE +

El Gato

El Gato targets Android OS and is distributed via a legitimate cloud service provider.

LEARN MORE +

Erebus

Erebus targets Windows OS and its method of distribution is currently unknown.

LEARN MORE +

ERIS

ERIS ransomware, originally identified in May 2019, was discovered proliferating via a malvertising campaign using the RIG exploit kit over the 4th of July, 2019 holiday weekend.

LEARN MORE +

Exotic Ransomware

Exotic Ransomware targets Windows OS and, as it appears to still be in development, its method of distribution is currently unknown.

LEARN MORE +

F

Fantom

LEARN MORE +

Fatboy

LEARN MORE +

FBI MoneyPak Ransomware

LEARN MORE +

FenixLocker

LEARN MORE +

Filecoder.E

LEARN MORE +

FilesLocker

LEARN MORE +

FireCrypt

LEARN MORE +

FLocker

LEARN MORE +

FrozrLock

LEARN MORE +

FSociety

LEARN MORE +

G

GandCrab

LEARN MORE +

GIBON

LEARN MORE +

Globe

LEARN MORE +

GlobeImposter

LEARN MORE +

GPAA

LEARN MORE +

GPCode

LEARN MORE +

H

HC7

LEARN MORE +

HDDCryptor

LEARN MORE +

Heimdall

LEARN MORE +

Hermes

LEARN MORE +

Hidden Tear

LEARN MORE +

Hitler-Ransomware

LEARN MORE +

HolyCrypt

LEARN MORE +

J

Jaff

LEARN MORE +

JapanLocker

LEARN MORE +

Jigsaw

LEARN MORE +

JuicyLemon

LEARN MORE +

K

Karma

LEARN MORE +

Karmen

LEARN MORE +

KillDisk

LEARN MORE +

KimcilWare

LEARN MORE +

Kirk

LEARN MORE +

Koler

LEARN MORE +

KozyJozy

LEARN MORE +

Kraken Cryptor

LEARN MORE +

L

LeakerLocker

LEARN MORE +

Lilocked (Lilu)

LEARN MORE +

Linux.Encoder

LEARN MORE +

LockCrypt

LEARN MORE +

Lockdroid.E

LEARN MORE +

LockerGoga

LEARN MORE +

LockerPIN

LEARN MORE +

LockID

LEARN MORE +

LockLock

LEARN MORE +

Locky

LEARN MORE +

Lost_Files

LEARN MORE +

M

M4N1F3STO

LEARN MORE +

MacRansom

LEARN MORE +

Magniber

LEARN MORE +

Maktub Locker

LEARN MORE +

MarsJoke

LEARN MORE +

Matrix

LEARN MORE +

Maze

LEARN MORE +

MedusaLocker

LEARN MORE +

MegaCortex

LEARN MORE +

Merry X-Mas

LEARN MORE +

MIRCOP

LEARN MORE +

MM Locker

LEARN MORE +

MoneroPay

LEARN MORE +

MSIL/Samas.A/Samsam

LEARN MORE +

N

NanoLocker

LEARN MORE +

Nemty

LEARN MORE +

Nemucod

LEARN MORE +

Netix

LEARN MORE +

NoobCrypt

LEARN MORE +

Nuke

LEARN MORE +

O

ODCODC

LEARN MORE +

OpenToYou

LEARN MORE +

Ordinypt

LEARN MORE +

OzozaLocker

LEARN MORE +

P

PadCrypt

LEARN MORE +

Paradise

LEARN MORE +

PetrWrap

LEARN MORE +

Petya

LEARN MORE +

Phobos

LEARN MORE +

PizzaCrypts

LEARN MORE +

PokemonGo Ransomware

LEARN MORE +

Popcorn Time

LEARN MORE +

Power Worm

LEARN MORE +

PowerWare

LEARN MORE +

Princess Locker

LEARN MORE +

PSCrypt

LEARN MORE +

PureLocker

LEARN MORE +

PyCL

LEARN MORE +

Q

qkG

LEARN MORE +

R

R980

LEARN MORE +

RAA

LEARN MORE +

Radamant

LEARN MORE +

Ragnarok

LEARN MORE +

Ranion

LEARN MORE +

Ransoc

LEARN MORE +

RANSOM_BLACKHEART

LEARN MORE +

Ransom32

LEARN MORE +

Rapid Ransomware

LEARN MORE +

RedBoot

LEARN MORE +

RektLocker

LEARN MORE +

RensenWare

LEARN MORE +

Reyptson

LEARN MORE +

RobbinHood

LEARN MORE +

Rokku

LEARN MORE +

RSAUtil

LEARN MORE +

Ryuk

LEARN MORE +

S

Sage

LEARN MORE +

Sanctions

LEARN MORE +

Satan

LEARN MORE +

Satana

LEARN MORE +

Saturn Ransomware

LEARN MORE +

Scarab

LEARN MORE +

Shark

LEARN MORE +

Shifr

LEARN MORE +

Sigma Ransomware

LEARN MORE +

Sigrun

LEARN MORE +

Simple_Encoder

LEARN MORE +

Simplelocker

LEARN MORE +

Smash!

LEARN MORE +

Smrss32

LEARN MORE +

Snake/Ekans

LEARN MORE +

Snatch

LEARN MORE +

SNSLocker

LEARN MORE +

Sodinokibi

LEARN MORE +

SOREBRECT

LEARN MORE +

Spora

LEARN MORE +

Stampado

LEARN MORE +

Stolich

LEARN MORE +

StorageCrypt

LEARN MORE +

SunCrypt

LEARN MORE +

SynAck

LEARN MORE +

SyncCrypt

LEARN MORE +

T

Telecrypt

LEARN MORE +

TeslaCrypt

LEARN MORE +

Thanatos

LEARN MORE +

TorrentLocker

LEARN MORE +

TowerWeb

LEARN MORE +

Trojan.Encoder.6491

LEARN MORE +

Troldesh

LEARN MORE +

TrueCrypter

LEARN MORE +

Tyrant

LEARN MORE +

U

UIWIX

LEARN MORE +

Unlock26

LEARN MORE +

Unlock92

LEARN MORE +

UNNAM3D

LEARN MORE +

V

Velso Ransomware

LEARN MORE +

VenusLocker

LEARN MORE +

VindowsLocker

LEARN MORE +

VirLock

LEARN MORE +

W

WannaCry

LEARN MORE +

WannaLocker

LEARN MORE +

WildFire

LEARN MORE +

WYSIWYE

LEARN MORE +

X

XData

LEARN MORE +

Xorist

LEARN MORE +

XPan

LEARN MORE +

XRTN

LEARN MORE +

Z

ZCryptor

LEARN MORE +

Zenis

LEARN MORE +

Zimbra

LEARN MORE +

ZipLocker

LEARN MORE +

Zyka

LEARN MORE +

New Jersey Cybersecurity & Communications Integration Cell

2 Schwarzkopf Dr, Ewing Township, NJ 08628

njccic@cyber.nj.gov

OUR COMMITMENT

The NJCCIC is a component organization within the New Jersey Office of Homeland Security and Preparedness. We are the State's one-stop-shop for cyber threat analysis, incident reporting, and information sharing and are committed to making New Jersey more resilient to cyber threats by spreading awareness and promoting the adoption of best practices.

STAY CONNECTED:

View our Privacy Policy here.

View our Site Index here.

NAVIGATION