Pump Ransomware

The Pump Ransomware is a file-locking Trojan that's independent of any known family. The Pump Ransomware can block files such as documents with encryption, change their extensions, and leave a ransom note in a TXT format that recommends victims contact the attacker's e-mail. Windows users should have backups to protect their files and recover any encrypted work and have established anti-malware applications delete the Pump Ransomware.

Priming the File-Ransoming Pump

As unmistakable as the footprints of Ransomware-as-a-Services and similar Trojans' gatherings are, the threat landscape also is full of 'lesser' programs accomplishing the same attacks on a smaller scale. To wit, the Pump Ransomware and similarly-independent Trojans may employ encryption and other features that are long-since polished parts of such campaigns, but with the added problem of individuality. Any victim of the Pump Ransomware will experience many attacks by-the-numbers, but malware experts also warn of the new Trojan's clear manual guidance.

The Pump Ransomware is a Windows threat that blocks files through encryption, using an unidentified algorithm and security standard. Most Trojans, including this one, use encryption as a means of sabotaging documents, pictures, and virtually all other important formats of files, which they then hold as hostages while demanding a ransom. The Pump Ransomware lets victims know which files it locks through appending 'pump' extensions but lacking the usual ransom-related information that similar threats display.

The Trojan also asks for a ransom – of a non-specified currency – with an English-language text note. The message uses wording that malware analysts can't connect to previous threats and seems unique to the Pump Ransomware's campaign. The e-mail appears randomly-generated. There's also an ID for each victim – and a claim that 'sensitive' information has is in the attacker's hands.

Stopping a Network from Becoming a Trojan's Pump-and-Dump Operation

Although malware researchers only can verify a single victim, currently, the Pump Ransomware's campaign is using business entity-targeting strategies, which are appropriate for breaching the security around entire networks or server infrastructure. Threat actors may brute-force their way into accounts with weak passwords, especially admin-privileged ones, or depend on software vulnerabilities. In other cases, workers can endanger their systems through opening disguised e-mail attachments that deliver Trojans or obfuscated links from text messages with similar results.

Because the strength of the Pump Ransomware's encryption is totally-unknown, victims should retain samples, if possible, for submission to experts and relevant threat databases. Assuming a solution to its file-blocking feature is impossible, Windows users can always retrieve their files from a secure, non-local backup, as malware researchers always recommend having. While a possible recovery solution, the ransom is fraught with risks, both deliberate and accidental on the part of the criminal.

Competent anti-malware products for Windows environments should flag and remove the Pump Ransomware as a threat. However, updates to databases may be necessary for guaranteeing as early and accurate a detection as possible.

With a possible ransom already in its history, the Pump Ransomware is off to a strong start for a virtually-unknown Trojan. Quiet and small isn't a mark of harmlessness; with Trojans, like poisonous snakes, the worst injuries can come from easily-neglected aggressors.