Aleta Ransomware

The Aleta Ransomware is an updated version of the BTCWare Ransomware, following the public release of encryption information related to the last branch of the family. This new version of the Trojan isn't open to free decoding currently and will continue to lock your files until you pay a ransom for them. Use backups saved externally to keep your content safe from Trojans of this type, and anti-malware products for uninstalling the Aleta Ransomware after an attack.

Making Money from Remote Desktop Extortion

As of the first week of July, RDP vulnerabilities, while always prominent for empowering the distribution side of Trojan campaigns, now are becoming even more favored among newer attacks. Both independent threats like the Lalabitch Ransomware and the youngest version of the BTCWare Ransomware family, the Aleta Ransomware, are abusing Remote Desktop features to compromise business and recreational systems. Unfortunately, malware experts also can confirm that the Aleta Ransomware is including a modified encryption algorithm, which prevents any old keys from unlocking your files.

Con artists are installing this last threat after compromising arbitrary servers through brute-force hacking methods or other strategies, such as phishing attacks, that get them access to the network logins. When launched, the Aleta Ransomware conducts several attacks typical of its family and similar ones like it. All of these activities conceal themselves within background processes, with no UI, and include:

• The Aleta Ransomware deletes SVC backups that the victim could use to recover anything it blocks.
• The Aleta Ransomware locks, via a standard data-enciphering algorithm, media such as movies, pictures or documents. The names of these files also have appended extensions showing the threat actor's e-mail address and the '.aleta' string.
• The Aleta Ransomware issues CMD-based commands for disabling the Windows data recovery and system repair features.
• Last, the Trojan appears to use both an image and a text-based ransoming message. The details adhere to many of the previous traditions in this form of extortion, as per malware experts last analyses of the BTCWare Ransomware family, including a time limit, a 'free trial' of the decryptor, and a ransom transaction occurring through the Bitcoin cryptocurrency.

Impoverishing the Next Member of a Trojan Family

Although early samples were, at first, presumed to be a new version of the Amnesia Ransomware, the Aleta Ransomware is now verifiable as being an update to the BTCWare Ransomware, with a new name and encryption cipher to keep any files it locks from being salvageable by public methods. Along with its eliminating local backups, the Aleta Ransomware also is targeting network-accessible storage devices for encrypting. Malware experts suggest detaching any essential backup devices when they're not in use, and password protecting your network data storage.

Acquiring help from the Aleta Ransomware's threat actor is the only known way to reverse its encoding attack. You can prevent infections and the need of resorting to potentially non-beneficial Bitcoin payments by monitoring your network settings, using good password habits, closing vulnerable ports, and keeping track of your RDP settings for tampering. Remote attackers also may install other threats, in addition to the Aleta Ransomware, and victims always should use conclusive anti-malware scans for deleting the Aleta Ransomware.

The BTCWare Ransomware's admins are busy at work with the next generation of their 'product.' Whether the Aleta Ransomware manages to be as successful as its ancestors, however, remains up to the PC owners it attacks.