Globe Imposter 2.0 Ransomware

The Globe Imposter 2.0 Ransomware is an update of the Globe Imposter Ransomware with changes to its ransoming message and encryption cipher. Because the Globe Imposter 2.0 Ransomware includes additional protection against public decryptors, any victims will need to recover their locked files from backups. Malware experts also encourage blocking and deleting the Globe Imposter 2.0 Ransomware preemptively with your anti-malware protection particularly, instead of paying its ransom, an act that may not give you a decryption solution.

One Trojan Takes Another Step in the Race against Cyber Security

Even as the Globe Ransomware families continues growing, imitations of it also are struggling to make money off of victims who can't tell the difference between one Trojan and cheap facsimiles of it. Unfortunately, for one copycat, the Globe Imposter 2.0 Ransomware, this superficial resemblance doesn't correspond with a weak data-encoding feature. Any files blocked by the Globe Imposter 2.0 Ransomware may be irretrievable without the user's having access to previous, unaffected copies.

Similarly to previous versions, the Globe Imposter 2.0 Ransomware is targeting victims with Russian and English as their native languages, although malware experts have yet to confirm which infection vectors the threat uses. After opening, the Globe Imposter 2.0 Ransomware scans the PC for documents, spreadsheets, pictures, and other, general formats of media to encipher with its encryption algorithm. Besides blocking these files, the attack also includes an extension-adding function that adds '.pizdec' (which translates roughly to a Russian obscenity) to the ends of their names.

Malware experts also observed some small modifications to the other component of the Globe Imposter 2.0 Ransomware's payload: its ransom note. Now, this file is an HTML, instead of HTA, although the threat actors still ask for the same kind of Bitcoin-based payment for helping you unlock your files. Since the Globe Imposter 2.0 Ransomware's ransoms are converting to equivalents of over thirty thousand USD currently, malware experts presume that the Trojan's campaign is attacking the private servers of unprotected businesses, and similar entities, with the capacity to pay significant amounts of money.

Beating an Imposter to the Punch (and Your Files)

Updates to file-locking Trojans that seem to change very little about them, in reality, often hold 'surprises' for their victims and their data. Malware researchers have been able to verify that the Globe Imposter 2.0 Ransomware includes additional anti-decryption features that make it more difficult to decode any media that the Trojan blocks than previously. Therefore, protection for your files requires preventative security steps, such as backing up the contents of your drive to another PC or peripheral devices that the Trojan can't access.

Expected infection methods for the Globe Imposter 2.0 Ransomware's campaign include spam e-mails that uses targeted, forged content of interest to the reader (such as a fake invoice or delivery alert), corrupted Web content that can instigate drive-by-downloads, and brute-force compromises of a server's login credentials. Careful management of your passwords, disabling scripts, and scanning downloads with anti-malware programs can reduce your potential contact points with such vulnerabilities or remove the Globe Imposter 2.0 Ransomware preemptively.

The Globe Imposter 2.0 Ransomware isn't a real version of the Globe Ransomware, but to someone struggling to recover their encrypted files, the difference may be a trivial one. Like the old Trojan that its ransom note mimics, the Globe Imposter 2.0 Ransomware uses relatively straightforward enciphering technology to hold digital content hostage for as long as its threat actor desires.

Update November 30th, 2018 — The 'bizarrio@pay4me.in' Ransomware

The 'bizarrio@pay4me.in' Ransomware is a member of the Globe Imposter 2.0 Ransomware family and, unfortunately, this means that a free decryptor is not available. If you believe that you are one of the 'bizarrio@pay4me.in' Ransomware’s victims, then we advise you to stay calm and not take any rash decisions, since this might not end well for your wallet and your files.

The 'bizarrio@pay4me.in' Ransomware works by encrypting the files on the victim’s computer and then offers to provide them with a decryptor, which can be obtained in exchange for a ransom payment. Although this solution might sound attractive despite the high price, you should think twice whether it is worth it to trust the anonymous crooks behind this project. Many ransomware victims have been tricked out of their money in the past, and the authors of the 'bizarrio@pay4me.in' Ransomware do not offer reliable proof that they will not do the same if you pay them.

All files locked by the 'bizarrio@pay4me.in' Ransomware will have the ‘.crypted_bizarrio@pay4me_in’ extension added to their names. In addition to this, the victims also will find a short ransom note, which tells them to contact either bizarrio@venom.io or bizarrio@pay4me.in for further instructions and information. We assure you that messaging the operators of the 'bizarrio@pay4me.in' Ransomware is a bad idea because they are unlikely to help you out for free.

The correct way to deal with the consequences of a ransomware attack is to remove the threatening program with the use of a trustworthy anti-virus tool immediately. When this task is complete, you should try to restore the original versions of your encrypted files by using a popular data recovery utility.

Technical Details