MrJeck Ransomware

A new file-locker is being distributed online and, unfortunately, its victims will be stuck in a very unfortunate situation because of the lack of a free decryptor compatible with this threat. When the MrJeck Ransomware takes over a computer, it will start encrypting files immediately. It targets a long list of file formats, the majority of which are frequently used, such as documents, images, archives, databases, backups, etc. When a file is locked, the ransomware adds a new suffix to the original name – '[<VICTIM ID>].[MrJeck@Cock.Li].' It also uses the document 'Read Me Please!.txt' to deliver a ransom message to its victim.

The note created by the attackers does not reveal much about the attack. The criminals do not offer any proof that they have what it takes to recover the victim's files, nor do they mention the amount of money they expect to receive. Instead, they advise the victim to message them at mrjeck@cock.li, mrjeck@protonmail.com, and mrjeck@tuta.io for help.

Trying to contact the criminals is unlikely to be of any help because they will only help if they receive a cryptocurrency payment first. Of course, sending money to cybercriminals is a terrible idea that you should not consider. Fulfilling their demands is not a guarantee that you will get your data back – it is more likely that they will take the money and stop responding to your message.

Victims of the MrJeck Ransomware should use a malware removal tool to eliminate the threatening software, and then experiment with popular data recovery software.