'Lavandos@dr.com' Ransomware

The 'Lavandos@dr.com' Ransomware is an update of the Dharma Ransomware and shares that Trojan's capabilities for locking files through encryption. Because such attacks aren't always subject to decoding, malware experts recommend using backups to recover from most infections by threats of this type. Active anti-malware products also can detect and remove the 'Lavandos@dr.com' Ransomware when appropriate, such as by identifying any concealed installers within e-mail attachments.

A More Communicative Trojan than Ever Before

In the middle of last month, malware researchers analyzed an emerging campaign from a possible variant of the Crysis Ransomware. This new Trojan, known as the Dharma Ransomware, showed inconsistent attack behavior and was notable for delivering limited information per infection to the victims largely (mostly consisting of e-mail addresses for its extortion communications). Its authors seem to have expanded the Trojan's ransom demands in a new release of the Trojan, the 'Lavandos@dr.com' Ransomware, already being seen in multiple nations throughout the world.

When it gains system access, the 'Lavandos@dr.com' Ransomware uses a similar file-appending function to its ancestor that includes an ID tag for the victim's use. Along with the name changes, the targeted content is encrypted to block it from being opened by any associated programs, a tactic commonly used by extortionists for ransoming documents and other, high-value digital content. While malware experts have yet to verify which cipher the 'Lavandos@dr.com' Ransomware uses for locking your files, it doesn't appear to be using a known version of the AES or Rijndael.

The 'Lavandos@dr.com' Ransomware's payload also has some new additions, such as an image-loading feature for delivering its extortion instructions. It warns the victim against trying any free decryption solutions and recommends communicating over e-mail for further help in recovering your content, most likely at a premium.

Sending the 'Lavandos@dr.com' Ransomware Off for the Holidays

Although the Trojan uses messages targeting English speakers, there are no patterns in the 'Lavandos@dr.com' Ransomware's distribution statistics. Europe, the United States, the Philippines and Canada are current examples of regions seeing live attacks. The Dharma Ransomware family has previous ties to brute-force password-cracking attacks that may compromise network-accessible systems of businesses on a manual basis. Other file-encrypting Trojans more often install themselves through spam e-mails, after hiding their Trojan droppers as supposed work documents, delivery notifications, invoices or spreadsheets.

While some free decryption utilities may be capable of decoding any files that the 'Lavandos@dr.com' Ransomware locks heuristically, the PC security institution has yet released a custom tool for the 'Lavandos@dr.com' Ransomware or the Dharma Ransomware. Since con artists may not keep their word and help you unlock your files after taking their ransom money, malware experts don't recommend paying them. For PC users who can't block the 'Lavandos@dr.com' Ransomware beforehand with anti-malware services, backups to external drives and servers provide the most convenient way of recovering data.

Small families of Trojans like the 'Lavandos@dr.com' Ransomware's tribe are not necessarily lesser risks, compared to larger ones. For the unprepared, even a brief 'Lavandos@dr.com' Ransomware infection could be giving them the 'gift' of permanent file damage for the Christmas season.