aZaZeL Ransomware

The aZaZeL Ransomware is a Trojan that locks your files so that it can force you to purchase its decryption application. Although such applications may or may not provide viable data recovery, malware experts recommend using more reliable and free alternatives, when possible, such as restoring from your latest backup. Most dedicated anti-malware products should be able to remove the aZaZeL Ransomware either after its attack or before it infects your computer.

Trojans Putting a Judaic Twist on Their Hostage Snatching

Late June is seeing the rise of another prospective campaign dealing out non-consensual extortion to try and profit from the content that it locks. This new threat, the aZaZeL Ransomware has had no verifiable infections in the business sector or with other, likely targets, although its encryption feature seems functional. Components of this Trojan also imply that its threat actors are planning on deploying it as part of a relatively large campaign, possibly even via a botnet.

The Hebrew-themed the aZaZeL Ransomware (whose name references the ancient ritual of scapegoating and most likely was chosen for intimidation purposes purely) uses an unidentified encryption method to lock different files on your PC. Traditionally, malware analysts recognize documents and other, work-related media being likely of being encrypted especially, along with media like pictures or compressed archives. As part of the feature, the aZaZeL Ransomware also flags the names of all illegible content with the '.Encrypted' extension, which it inserts after the old one.

Although the aZaZeL Ransomware uses a similar extension string as other, file-encrypting Trojans, victims also can identify it via the Notepad message it creates. This note is nearly identical to some instructions in use with the Globe Ransomware family previously and requests payment through Bitcoins for unlocking your files. The low fee that its threat actors require is suggestive of the aZaZeL Ransomware's not being meant for compromising corporate targets, although small business and recreational PC users remain at possible risk.

Putting Trojans out to Pasture

Because of how early in its campaign development the aZaZeL Ransomware is, how its threat actors plan to distribute it isn't verifiable, nor can malware experts confirm the Trojan's being compatible with any free decryptors. Copying encrypted media before trying to restore it can prevent victims from causing any other, irreversible damage to their files. Because decryption availability always is a gamble, most users who need to defend their data from these attacks should invest in backups.

Threat actors use a range of methods for distributing Trojans with file-encrypting features, encompassing website exploits, e-mail attachments, brute-forcing passwords, and bundling the malicious software with free downloads. Most anti-malware products include features for isolating and preventing these attacks, although password management and download behavior always are up to the user to monitor. Because of the uncertainty of free decryption, blocking the aZaZeL Ransomware with anti-malware protection, instead of removing the aZaZeL Ransomware infections afterward, always is the default recommendation of malware experts.

Whether the aZaZeL Ransomware's creator is another client for the Globe Ransomware's RaaS business model or not, new Trojans mean new infiltration methods and security risks. Neglecting backing up your files or scanning new downloads is just what threat actors like the aZaZeL Ransomware's author want from their future victims.