Fireee Ransomware

The Fireee Ransomware is a file-locking Trojan that's part of the small family of the Makop Ransomware. The Fireee Ransomware can block most files on infected Windows computers through encrypting them with AES and may conduct additional attacks, such as delivering extortionist ransom notes, changing files' names or wiping some backups. Users with anti-malware tools can remove the Fireee Ransomware safely and should use any unharmed backups for data restoration.

A Fire Starts with Files as Kindling

Despite not being nearly one of the larger, nor even medium-sized families of file-locking Trojans, the appearance of near versions of the Makop Ransomware throughout 2020 is not a surprising phenomenon. This Windows threat leverages features for sabotaging media and making hostages out of files until the victim pays a ransom, much like the Crysis Ransomware, the STOP Ransomware and innumerable others. Since the Fireee Ransomware campaign, it still is running strong.

For Windows users at the wrong end of infection, the Fireee Ransomware's worst feature is its AES-based, RSA-protected encryption. This attack blocks media files of most formats, such as documents, pictures, music or movies. Superficially, it also adds extensions and some ransom-related credentials (the attacker's e-mail and an ID for the victim) onto their names. The latter is useful for identifying any blocked files and the Fireee Ransomware instead of similar Trojans using other extensions.

The Fireee Ransomware uses the same question-and-answer format of TXT ransom note as most other versions of the Makop Ransomware group, which also includes the Origami Ransomware, the Shootlock Ransomware, the ZES Ransomware, and the Zbw Ransomware, as some examples. The generic English instructions direct victims to e-mails for negotiating over an unlocking service that recovers the files at a vague cost – although users should remember the dangers of bargaining with potentially-dishonest criminals.

Putting Out the Heat on Precious Data

Like any file-locking Trojan, the Fireee Ransomware preys on users whose files are inadequately protected by local backup solutions. Users can easily spare themselves any extortion by creating copies of their work on safe, secondary devices, such as removable USBs or a cloud service. Since there are no verifiable infection scenarios for the Fireee Ransomware's new campaign, most Windows users worldwide should consider themselves at risk and remember that Restore Points, alone, aren't a sufficient fail-safe.

Users also should maintain Web-browsing precautions that block nearly all of the drive-by-download exploits, phishing lures and tactics that file-locker Trojans employ. Disabling features like JavaScript and Flash while updating software regularly from official websites limits most vulnerabilities to a minimum. Password strength is also an essential element in blocking brute-force attacks from compromising servers or networks. Most users will benefit from scanning e-mail attachments or other downloads before opening the files.

A minority of cyber-security solutions will flag this threat as part of the Phobos Ransomware family, which is a recurring issue with Makop Ransomware's variants. Besides this minor issue, most security programs will identify and remove the Fireee Ransomware as a danger to the PC correctly.

How much the Fireee Ransomware expects of reaping from its ransom demands is questionable, but data encryption is a trap that works best on those who forget their susceptibility to it. The more users do for strengthening their security and backups, the less up-and-coming threats like the Fireee Ransomware can pose problems.