Protect Ransomware

The Protect Ransomware is a file-locking Trojan from the Hydra Ransomware family. The Protect Ransomware can block files with attacks that encrypt their data and change their extensions, with media like documents being at high risk. Users should back their files up safely for recovery needs and let a trusted anti-malware product remove the Protect Ransomware as soon as possible.

A Hydra Grows Another Head for Savaging Files

The multi-headed reptilian beast of Greek myth, the hydra, is getting a more prominent role in the threat landscape, after the long-ago depredations of HydraCrypt Ransomware. Another family with the same theme, the Hydra Ransomware, is starting to make the rounds in the wild, with the Protect Ransomware as one of its first and most visible variants. The Protect Ransomware visually distinguishes itself from the HydraCrypt Ransomware's family through different – and sloppier – extortion methods that suggest an 'amateur' production.

The Protect Ransomware follows the core attack protocols of most file-locking Trojans today, like the Scarab Ransomware from Russia or the Southeast Asia STOP Ransomware family. It searches for digital media (documents, pictures, spreadsheets, music and other formats) that it can convert into non-opening copies through secure encryption. The Protect Ransomware is, however, slightly larger than similar threats, with a Windows executable size of over two megabytes.

The ransom note, a text message, is both the Protect Ransomware's distinguishing factor from the HydraCrypt Ransomware family and an important clue as to the threat actor's limited programming experience. The Trojan drops copies of the ransoming message into most directories on the PC instead of a single, centralized location, like the desktop. The letter is semi-unique, offering a three-file demonstration of the decryptor for unlocking files as well as an e-mail for further negotiations.

The Protection from Monsters that You can Count On

Malware researchers warn users of avoiding the ransom, if possible, due to the risks of these payments not giving any unlocking service. While the Protect Ransomware has no features associated with the Shadow Copy deletion or network traversal, all Windows users should schedule and store their backups as safely as possible for data recovery. Most file-locking Trojans use secure encryption that's, essentially, unbreakable, even by seasoned cyber-security researchers.

While the Protect Ransomware is a Windows-only threat, the installation schemes related to it are murky. Criminals sometimes target victims through e-mail phishing lures, but more random methods, such as corrupted websites and torrents, are equally possible. Minimizing interactions with potentially-untrustworthy downloads, and scanning files before opening offers significant protection from nearly all threats.

Users should uninstall the Protect Ransomware using appropriate anti-malware software for confirming their PC's safety from both this Trojan and any secondary threats. In some cases, file-locker Trojans are 'distractions' for spyware and other software that conducts more clandestine attacks than blocking media.

The Protect Ransomware's family is just starting its growth, but the hydra of folklore is legendary for its regenerative capabilities. Hopefully, the Protect Ransomware's ancestry will prove itself less robust than its Greek origin.