Revolution Ransomware

The Revolution Ransomware is a Trojan that locks your files to keep them unusable while the threat actor waits for you to pay a ransom for his unlocking service. Although the Revolution Ransomware is similar to other Trojans of its category symptomatically, malware experts recognize it as an independent program without being a resident of families like the Xorist, and the CryptMix Ransomware. PC users at risk of infection should back up their work to another device and install anti-malware products for removing the Revolution Ransomware.

A Revolution in Trojan Engineering with Borrowed Slogans

Identifying new Trojans often results in pursuing fruitless trails that offer zero or inaccurate results. Although an individual symptom that's present in an attack, such as how a Trojan renames a file, may be a positive indication of its code's point of origin, in other instances, such signs that are misleading intentionally. The Revolution Ransomware exemplifies such trends by being an independent threat that is currently, widely classified incorrectly as a variant of the Synack Ransomware.

The Revolution Ransomware's campaign is in the deployment phase of its operations and appears to focus its attacks against vulnerable, server-based PCs in the business sector. After gaining access through methods such as email or brute-force attacks, the Revolution Ransomware generates both a 'customer' ID for the victim and an encryption key and uploads this data to an external server. Then, it begins encoding any media formats on the local hard drives. Like similar Trojans, the Revolution Ransomware adds its custom extension to the name of every file it locks (the '.revolution' string).

The Revolution Ransomware also creates a text message that malware experts last found circulating in the payload of the MOLE Ransomware. These instructions ask you to pay an unspecified amount within several days, along with providing such information as the ID and the threat actor's email. Whether the RSA-based encryption method the Trojan describes in its note is accurate has yet to be verified by our malware analysts, although no free decryption solutions are compatible with this threat, as of early September.

Bringing an Early End to Not-So-Revolutionary Filing Problems

The Revolution Ransomware has, so far, confused its identity in current threat databases for various major AV vendors successfully, which can increase the possibility of a victim using the wrong decryption tools for recovering their media. When trying to unlock your files through freeware methods, always test backup copies of the encrypted content, in case the resulting decryption causes irreversible data corruption. Malware experts also stress the value of having backups predating an attack to keep Trojans like the Revolution Ransomware from being able to extort money through threats to your data routinely.

Threat actors often lead attacks against server-based infrastructure by abusing email attachments or brute-forcing their way through confidential, but quickly broken login combinations. Sophisticated user name and password choices can keep brute-force hacking tools from giving a remote attacker access to your PC without your consent. A majority of anti-malware programs also may remove the Revolution Ransomware on sight, although many of them will detect it under an inaccurate label.

Always be careful about what actions you take to undo the impact of a Trojan's infection. Something as minor as a misstep in determining what family a file-locking program belongs to can turn into file damage that the likes of even the Revolution Ransomware's decryptor can't decode readily.