Mespinoza Ransomware

The Mespinoza Ransomware is a file-locking Trojan that has no known family. It can, like similar threats, stop files from opening by encrypting them, change their extensions, and create messages with ransom demands. While an unaffected backup could be the only viable recovery method for any files, users also can depend on their anti-malware products for removing the Mespinoza Ransomware or blocking attacks that could install it.

Anti-Company Trojans on the March for Money

Most Trojans with file-locking features are part of a much larger movement than themselves, whether it's scavenging Utku Sen's Hidden Tear's code or partaking in a Ransomware-as-a-Service family such as the Djvu Ransomware. It's not true of every possible example, however, and malware researchers see signs of periodic exceptions throughout the current year. The Mespinoza Ransomware is one of the latest of these solo-operating threats.

With victims in Brazil and at least one, other, English-speaking region, the Mespinoza Ransomware's campaign is out in the wild and circulating through unexamined exploits. Due to a payload that presumes companies as the victims, likely, some combination of server configuration exploits, brute-forcing credentials, or corrupted e-mail is part of the Mespinoza Ransomware's installation strategy. Most of these vulnerabilities are preventable as long as workers maintain standard security practices on company networks.

The Mespinoza Ransomware encrypts files for stopping them from opening and includes an additional 'locked' extension on their names, for identifying purposes. The latter is a symptom that the Mespinoza Ransomware shares with the PyLock Ransomware, the AndreaGalli Ransomware, the Cyber Police Ransomware and many other threats. Users should be especially careful about selecting unlocking software – since running the wrong decryptor will cause more and permanent file damage.

Strongarming Your Files Back from a Trojan

While the Mespinoza Ransomware uses English for its ransom demands, the grammar is notably poorly, and the text is, likely, a byproduct of a translation tool. Hence, malware experts feel it serves inadequately as evidence of any regional targeting preferences in the Mespinoza Ransomware's campaign. Many file-locking Trojans do express some national preferences, however, such as the STOP Ransomware's leaning into the Philippines, or the Scarab Ransomware's Russian notes. Nevertheless, all parts of the world are at risk of encryption attacks.

Malware experts recommend securing backups onto additional devices for preventing the Mespinoza Ransomware from holding the entire contents of a PC hostage. Media, such as documents, pictures, or music, is especially at risk, but the Mespinoza Ransomware's encryption may impact content as different as executables and 3D modeling blueprints. There is no decryptor for the public's use against the Mespinoza Ransomware, and the Trojan's encryption strength is an unknown factor. Which companies the Mespinoza Ransomware is raking over the coals for money is uncertain, but any business who can't store their files properly is asking for extortion. The fact that there's one more extortionist to perform the crime is just emphasis on a previously-established point of fact.