Mkos Ransomware

The Mkos Ransomware is a file-locking Trojan that originates from the STOP Ransomware's Ransomware-as-a-Service. This family is known for its usually-secure encryption methodology, including deleting default Windows backups, and a propensity for delivering spyware. Users should delete the Mkos Ransomware immediately through trusted anti-malware services before resorting to an appropriate recovery solution such as a cloud-based backup.

Random Files Portending Predictable Consequences

Another catch of the STOP Ransomware members shows that both that users are remaining at risk for well-known infection exploits and that the Ransomware-as-a-Service industry is thriving. The Trojan of the hour, the Mkos Ransomware, dates to early December in its circulation, with unknown infection methods at play. Any Windows users encountering this threat, and not protected by appropriate security software – or, at least, a good backup – may find all of their files lost permanently.

A sample of the Mkos Ransomware with the seemingly-random name of '34efcdsax' is in the wild and compromising users alongside other undesirable software, such as cryptocurrency-mining Trojans and unwanted toolbars. So far, its encryption doesn't differ from the techniques of other, recent members of its family, such as the Chch Ransomware, the Msop Ransomware, the Nakw Ransomware and the Righ Ransomware. It runs AES-based encryption over digital media formats that include commonly-used documents, pictures, databases, spreadsheets, audio and archives. Importantly, the security of this encryption may vary depending on whether or not the Mkos Ransomware has a connection to its C&C server.

Other symptoms of the Mkos Ransomware also are traditional for its family and, in fact, most Ransomware-as-a-Services. It adds extensions with its name into file names, deletes the Restore Point recovery data, and creates a ransom note for providing its Bitcoin-based decryption service. Victims should reserve the latter as the last resort; any criminal may take their ransom and not give back any unlocking help, and this danger is a documented, recurring phenomenon, even in RaaS Trojans.

The Precautions that Keep Ransom Notes Away from Your Doorstep

Several steps can keep file-locking Trojans, especially the STOP Ransomware variants, from compromising your PC too quickly. Users should disable JavaScript, Java, and Flash while surfing the Web and update software for closing up vulnerabilities. Administrators can guard their login credentials carefully and avoid well-known ones related to factory settings or brute-forcible values. All users should be cautious of their downloads, such as invoices attached to e-mail messages, or illegal torrents.

Disabling one's Internet connection quickly could keep the Mkos Ransomware from contacting its server and using the most secure encryption method that's available. However, malware experts don't consider it likely or practical self-defense for most victims. Users should, in all cases, keep backups elsewhere for recovering as best as possible from a file-locking Trojan attack.

Windows anti-malware products will catch and delete the Mkos Ransomware, and all other variants from the STOP Ransomware's group virtually. The only thing that's new about the Mkos Ransomware is its name and the company it keeps. Lax security can end up inviting in more 'guests' than you'd planned on entertaining, and the results, for a computer's hard drive, can be dire.