Havoc Ransomware

The Havoc Ransomware is a Trojan that encrypts your files, uploads the decryption key to an external server, and sells access to the decryption process to its victims. Since encryption can damage your local files permanently, keeping a non-local backup is paramount to preventing this Trojan's payload from causing any harm that you can't reverse. Malware experts also encourage using dedicated anti-malware products for blocking the Havoc Ransomware before its attacks or deleting the Havoc Ransomware after them.

A Royal Tithing of Your Files

A threat actor self-describing himself as 'BinaryEmperor' is initiating a new file-encrypting Trojan campaign centering around the Havoc Ransomware, a threat that locks your files as a preliminary to ransoming them. Typically, it's unusual for threat actors to give themselves any identifying titles in their extortion messages. However, the Havoc Ransomware takes other steps to protect its author's anonymity and conducts what malware experts are rating as a relatively ordinary campaign.

The Havoc Ransomware encrypts files through an algorithm still under investigation, with the AES being the most common method in use, although others, such as XOR and Blowfish, are favorable in some niche Trojan families. Any files that the Havoc Ransomware encrypts and blocks from opening also acquire '.HavocCrypt' extensions for the victim's visual identification. It uploads the decryption key for restoring your data to a C&C server, giving the threat actor complete control over it. The Trojan also creates a custom ID that plays a part in the ransoming message the Havoc Ransomware displays afterward.

The pop-up that the Havoc Ransomware launches after that gives the victim a two-day countdown to make a 150 USD transfer in the Bitcoin cryptocurrency and buy the decryption service from its author. However, since the victim must make the transfer before contacting the threat actor's e-mail for help, there are no guarantees of real decrypting help being forthcoming. The Havoc Ransomware's message also threatens to delete the key in the event of any actions taken to protect the computer or disable the Trojan. Malware experts often see similar threats in other campaigns, although the act is rarely automated and often is a bluff to keep the Trojan online.

Refusing a Self-Crowned Emperor's Levy

While the Havoc Ransomware's messages claim that the Trojan is in 'MK II' of its version updates, malware researchers have yet to find any 'MK I' versions of the Havoc Ransomware or other, previous cases of this Trojan in deployment. Early versions of the Havoc Ransomware may be on the threat actor's testing environments, or the version number could be a bluff meant to make the threat look more sophisticated than its actual history would indicate.

Threat actors use Bitcoin as a preferred payment option to stop victims from retrieving their money if the decryption help either is nonexistent or malfunctions. While malware researchers see no current decryption solutions for the Havoc Ransomware, victims can upload appropriate samples to cyber security resources for analysis and expedite the development of such tools. For complete recovery of your locked files, use backups whenever possible.

Many anti-malware programs prove adequate at detecting and deleting the Havoc Ransomware heuristically, and the Trojan has no exception self-defensive characteristics. As is all too often the case, the Havoc Ransomware is reliant on victims being too afraid to take the only actions capable of saving their PCs due to the potential risk of losing any content that they didn't care enough to backup in the first place.