MGS Ransomware

The MGS Ransomware is a file-locking Trojan from a well-known Ransomware-as-a-Service family. The MGS Ransomware can lock media on your PC and may compromise it through corrupted advertisements, torrents or brute-force attacks. Users should emphasize rigorous backups scheduled combined with anti-malware services for removing the MGS Ransomware as a danger to their computers.

So-Called 'Important Documents' Ttat You Never Should Read

One of the top competing RaaS families, the Dharma Ransomware (AKA Crysis Ransomware), has another variant with typically-misleading filenames in its payload. Social engineering isn't new to this Ransomware-as-a-Service, which includes members as old as 2016's the 'Lavandos@dr.com' Ransomware, and as fresh as the 2019's CMD Ransomware, the Q1G Ransomware, the STAFS Ransomware, and the MGS Ransomware. However, the last of these uses what should be an easily-seen-through disguise for its payload.

As part of its system persistence, the MGS Ransomware generates an executable with the name of 'important_document' and places it in Windows Startup. Users may note that, unlike more sophisticated attempts at formatting disguises, the MGS Ransomware doesn't hide the 'exe' extension with a different, more appropriate one, like 'doc.' Its infection methods could be emphasizing document-delivery tactics, such as e-mail-attached invoices or industry news articles.

After this minor attempt at trickery, the MGS Ransomware proceeds with the rest of the payload, which consists of the same encryption and ransoming attacks that malware experts see throughout its family. The MGS Ransomware searches for media such as documents or images and blocks them with AES encryption that it secures with another, RSA algorithm. It also changes their extensions (to the one in its name), creates ransoming messages, and may remove the victim's backups.

Putting the MGS Ransomware into the Shredder

Backups are the most effective self-defense against file-locking Trojans, post-infection. While Windows provides the Restore Points by default, and some file-locking Trojans don't erase them or fail at doing so, malware experts recommend keeping your backups on other devices for the most security. The MGS Ransomware is one of many Trojans of its type that uses CMD-based commands for removing Windows backups, and any attacks also may try compromising network-attached storage or local servers.

Concerning stopping infections from happening, users can avoid illicit download resources and advertisement-based downloads, which are frequent infection vectors. Disabling risky browser features like scripts, using unique passwords for all accounts, and installing all available security updates are other means of protection. While none of these options are flawless cure-alls, file-locking Trojans like the MGS Ransomware, usually, will aim for the easiest targets.

Almost all anti-malware products will appropriately remove the MGS Ransomware and other members of its family as threats to your computer – although many brands are using generic detections for the Dharma Ransomware's family.

As malware experts continue urging the public to back their work up correctly, PC and phone owners aren't always heeding this oft-repeated advice. The MGS Ransomware is gambling on it and taking that bet to the bank.