Kronos Ransomware

The Kronos Ransomware is a file-locking Trojan that's part of the Zeropadypt Ransomware. These threats often acquire victims by taking advantage of vulnerable logins and network settings and block content for extorting money. Users can save their files with secure backups and use anti-malware programs as the preferred means of uninstalling the Kronos Ransomware or preventing an install exploit.

Rewinding Time to Past Trojans

A minor but highly-active family of file-locker Trojans, the Zeropadypt Ransomware, is responsible for another campaign that's trying to block media in exchange for getting paid in cryptocurrency. The variant, the Kronos Ransomware, uses an old e-mail address that the cyber-security industry has found on other Trojan samples from the same group. Although it's not definitive why the criminal made the switch, the Kronos Ransomware might be a detection-avoidance effort or only the renewing of a Trojan-hiring license.

The Kronos Ransomware's name comes from the Greek god of time, notorious for devouring his children to prevent a prophecy. In the same fashion, the Kronos Ransomware swallows files, by the usual means of encrypting them. It follows the format of changing their names that's consistent with the Zeropadypt Ransomware family and inserts a bracket-enclosed e-mail, an ID, and its extension ('KRONOS,' in this case). Victims should be careful about confusing this threat with the Kronos banking Trojan, which is also active in 2019 but conducts very different attacks, such as keylogging.

The Kronos Ransomware also leaves a text ransom message that asks for Bitcoins but doesn't give any particular price point. In some, but not all cases, this family's payloads are susceptible to reverse-engineering that could unlock your files without a charge. Alternately, all users can take advantage of responsible backup strategies that make the risk from the Kronos Ransomware infections irrelevant.

Telling the Kronos Ransomware that It's Time is Done

Besides the backup practices that everyone should partake of, users can defend their PCs from the Kronos Ransomware's family's preferred infection techniques. Windows users should avoid enabling RDP without a secure password, monitor their network ports for unsafe openings, and use passwords that aren't at risk of being brute-forced. Brute-forcing can crack both 'simple' logins, such as 'password123,' and the defaults that are specific to some kinds of hardware, such as routers.

If no backups are available and the Kronos Ransomware makes its way through your defenses, malware experts recommend quarantining the threat with security tools before contacting an established member of the cyber-security industry. Various companies provide free or premium decryption assistance, depending on the Trojan's identity and version. Nonetheless, not every Zeropadypt Ransomware variant is decryptable.

Anti-malware products for Windows environments should flag this Trojan as being a threat and delete the Kronos Ransomware before any encryption can happen. They also may uninstall it, if necessary, or isolate it for sample-analyzing purposes that could help with decryption.

Brazilian admins are reporting the Kronos Ransomware infections that are sabotaging entire servers' worth of media. However, automatic encryption isn't just a South American problem, but a worldwide, for-profit epidemic.