CyberDrill Ransomware

The CyberDrill Ransomware is a Trojan that uses encryption to lock media on your PC, including PDFs, DOCs, TXTs and others. A CyberDrill Ransomware infection also includes symptoms such as the depositing of ransom-themed messages via either pop-ups or text files and changes to the extensions of any blocked data. All PC users should try to stop this threat preemptively or remove the CyberDrill Ransomware as soon as possible with appropriate anti-malware products, and recover any content through backups instead of paying a ransom.

Programs Merrily Drilling through Your Data

While threat actors have numerous options for crafting Trojans with non-consensual, encryption-based attacks, Hidden Tear still is a preferred resource, possibly due to nothing more than its absence of a price tag. Even though variants like the CyberDrill Ransomware may not see a fully-operated campaign with broad, public dispersal necessarily, coincidental exposure to such threats continues putting the files on random PCs at risk. Malware experts only are seeing the CyberDrill Ransomware in an in-development state, although the majority of its payload already works due to the accidental 'help' of Utku Sen.

Test versions of the CyberDrill Ransomware that its threat actor is uploading to generalized security databases include limited encryption attacks that target a user directory on the desktop, although minimal work could adjust the Trojan's location parameters. The CyberDrill Ransomware still encrypts files of the same formats already preferred by the original Hidden Tear, including text documents, spreadsheets, pictures and slideshows. The CyberDrill Ransomware adds a '.locked' extension onto the names of any files it blocks this way, which is a symptom that it shares with other Trojans, both Hidden Tear-derived and otherwise.

The CyberDrill Ransomware may generate pop-ups imitating the template of the '.wcry File Extension' Ransomware's family, but also creates extra ransoming warnings and instructions through plain text messages. Besides asking for Bitcoins and providing an email address for negotiating, they also provide a decryption code for restoring the user's files. However, malware experts consider it likely that the author will remove this solution from full versions of the CyberDrill Ransomware for compromising the public, as opposed to the test versions currently available.

Turning Off the Drilling that could Go Too Deep

Depending on its author's adjustments to the CyberDrill Ransomware's Hidden Tear-based encoding feature, any files that the Trojan locks may or may not be decryptable for free. Contact security researchers with experience with the HT family to determine if any available decryption freeware might be compatible with your media. However, maintaining a robust backup schedule using secure devices also is recommended by malware analysts for keeping your files as safe as possible from any Trojans with similar, data-enciphering capabilities.

Until its threat actor begins distributing a finalized build, the cost of the CyberDrill Ransomware's ransom and how it plans to distribute itself remains theoretical. Malware analysts often find that business entities compromise themselves through employees opening email attachments or using unsafe passwords, while recreational PCs are more likely of suffering from an infection through downloading illicit media. Most anti-malware programs that have optimal detection rates for Hidden Tear traditionally also should delete the CyberDrill Ransomware safely either before it can attack or after it's already infecting your computer.

Since the con artists are unlikely of finding any easier to use sources of encryption-based harmful code, Hidden Tear relatives like the CyberDrill Ransomware are going to continue appearing. Those who might be under attack can best protect themselves and their data by not putting all their valuables in one, easily assailable place.