Qlkm Ransomware

The Qlkm Ransomware is a file-locking Trojan that's part of the STOP Ransomware or Djvu Ransomware, a long-running Ransomware-as-a-Service. It can harm users' files by encrypting them and stopping their opening and conduct related attacks like generating ransom notes, deleting backups and hijacking Web-browsing settings. Users should protect themselves with a well-defended backup for their work and keep Windows security products available to remove the Qlkm Ransomware.

Trojan Families Starting Off the New Year with Irony

Much remarked-upon for its refusal to do anything its name implies, the STOP Ransomware family of file-locker Trojans continues being a part of the threat landscape into the new year. Early versions like the Djvu Ransomware and 2019's codnat1 Ransomware give way to more contemporary models: the Npsg Ransomware, the Topi Ransomware, and gracing 2021, the Qlkm Ransomware. Although this version is the newest available to malware analysts, its feature set isn't very different from its kindred.

The Qlkm Ransomware is a Windows-based threat whose most essential attack is its encryption routine. This feature blocks files from opening and leaves them identifiable to victims by the extra extensions (which refer to the Qlkm Ransomware's campaign string, a set of four random characters). This feature is most threatening to widely-in-use media formats like documents, pictures, spreadsheets, databases, archives, et al.

The Qlkm Ransomware also can delete Restore Points, which deprives victims of a local recovery for their data. Although most STOP Ransomware versions drop two types of 'ransom notes,' only one is verifiable with the Qlkm Ransomware: a text message. This standardized set of directions prompts victims into paying a ransom for the family's unlocking service, with a standardized fee of almost five hundred USD, which doubles after a deadline.

Pushing File-Ransoming Services Back into the Past

Besides its more media-related features, the Qlkm Ransomware's family has a propensity towards blocking websites. It does this by changing the Windows Hosts file, which any user can restore to default settings quickly. In the meantime, Web surfers may find common security-related sites like AV vendor domains or Microsoft.com to be inaccessible.

Along with not panicking over the impact of infections and preventing them in the first place with appropriate security standards, users' most-important response involves backup preparation. Those with backups on other devices have every means available to restore their work without concern for the decryption process. Free decryptors that unlock files, while known for some, 'freeware' style Trojans, usually are impossible with families like the Qlkm Ransomware's STOP Ransomware business.

Robust PC security tools can block many of the Exploits Kits and other infection vectors that propagate Trojans of this type. Users also should avoid indiscriminate use of threatening features like JavaScript or macros and have strong passwords for network and admin accounts. Security services also will delete the Qlkm Ransomware preemptively in nearly every case.

The Qlkm Ransomware is the least-surprising new year's gift to unwrap: more of the same-old from Trojan businesses. Like their lawful counterparts, a black hat business will keep going until the profits evaporate and ransoms run out.