FlyStudio Ransomware

The FlyStudio Ransomware is a file-locking Trojan that blocks media files on Windows computers and holds them as hostages while asking for a ransom. The FlyStudio Ransomware campaign targets Chinese speakers and imitates Apple software for circulating, although future attacks may use different configurations. Users with both anti-malware programs for deleting the FlyStudio Ransomware and secured backups for recovery should be safe from this threat.

An Apple that's Rotten at the Core

English is the language favored for most of the file-locking Trojans that malware experts see, but some exceptions prove the rule. The FlyStudio Ransomware is a similarly data-sabotaging threat that assumes Chinese victims, although nothing is preventing it from being threatening outside of that country. Samples of the Trojan also are playing their hand clearly by showing exactly how they're getting into PCs in the first place.

The FlyStudio Ransomware is faking being Apple's iTunes software, with a combination of code packing and falsified file version credentials for completing the disguise. This detail alleviates one of its more notable drawbacks, a large size of over five megabytes, which is believable for an iTunes installer. Victims taking the Trojan's name at its word will experience some of the adverse effects possible for their files: wide-encompassing media encryption and unwanted Registry changes to their Web-browsing settings.

The encryption that makes up the FlyStudio Ransomware's core functionality can block most media, such as documents, music, or pictures, and includes an 'itunes' extension that tags each piece of data. After collecting these digital hostages, the FlyStudio Ransomware creates a Chinese text note on the user's desktop. However, the contents are prosaic and have no meaningful information apart from an ID for the ransoming transaction and an e-mail for negotiating with the threat actor over the data unlocker.

Flying Away from Poisoned Orchards

The FlyStudio Ransomware, whose name may derive from ancient adware or spyware threats, is an independent Trojan that's not part of families of ill repute like the STOP Ransomware, the Dharma Ransomware or the AES-Matrix Ransomware. Still, its features showcase the same methods of operation and desire for monetizing non-secure data. The Trojan's most distinguishing feature is its preference for targeting Apple software users, but inside of a Windows environment.

Windows users have many options for protecting their files from a potential attack by the FlyStudio Ransomware. Most cyber-security products can identify the FlyStudio Ransomware on sight, despite its packing. In addition to scanning their downloads, users might consider avoiding torrents and disreputable websites for their updates, turn off pop-ups and advertisements, and deactivate often-threatening features like JavaScript. Downloading Apple software from authorized sources and nowhere else should prevent most occasions where the FlyStudio Ransomware's campaign might strike.

Most professional security suites, as noted, will counter, contain and remove the FlyStudio Ransomware. Although disinfection should occur as soon as possible, it doesn't alleviate the need for a backup as the only definitive recovery option for the victim's files.

The FlyStudio Ransomware is flying high on the wings of a stolen brand name. Anyone installing new applications without checking where they're coming from is asking for being on the receiving end of the FlyStudio Ransomware's – so far unknown – ransom.