Scarab-X3 Ransomware

The Scarab-X3 Ransomware is a variant of the Scarab-Crash Ransomware from the Scarab Ransomware family. These file-locking Trojans can encrypt your media with an AES algorithm and stop documents, pictures, etc., from opening. Windows users can protect their PCs by uninstalling the Scarab-X3 Ransomware with appropriate anti-malware tools before recovering from their most recently-made backup.

Crashing Headlong into Another Bug

The Scarab Ransomware is a Ransomware-as-a-Service family whose hallmark feature is its Russia-based campaigns, but not every member is equally specific to eastern Asia. Some entries, like the Scarab-Leen Ransomware, the 'traher@dr.com' Ransomware, the Scarab-DD Ransomware, the Scarab-Bin Ransomware, or the Scarab-X3 Ransomware, attack English speakers preferentially. Since any threat actor can 'rent' a version of the Scarab Ransomware, other aspects of its distribution and infection exploits are in some degree of fluctuation.

The Scarab-X3 Ransomware is a new member and includes many symptoms that are direct copies of those of the Scarab-Crash Ransomware, but with different contact information. Like all of these threats, the Scarab-X3 Ransomware uses an AES encryption feature for blocking files and, after capturing them, removes the Shadow Volume Copies that the victims could avail themselves of for restoring them. Media types that malware experts see being at risk, still, include everything from Word documents to Excel spreadsheets, archives, and various pictures.

'Brute-force' style attacks are frequent in this family particularly and are one of several, likely infection vectors for the Scarab-X3 Ransomware's 2019 campaign. Network admins should avoid using too-easily-guessed passwords, or other login credentials, that brute-force software could crack. Remote attackers, in most cases, will limit themselves to dropping and running the file-locker Trojan but could install other threats besides the Scarab-X3 Ransomware, such as spyware or backdoor Trojans and RATs.

Giving the Scarab-X3 Ransomware None of the Glory

The Scarab-X3 Ransomware adds '.X3' extensions to the names of the media that it blocks, along with creating a Notepad ransoming message for an unlocking service. The latter's only change from the old Scarab-Crash Ransomware is its new e-mail addresses: 'glorypay' at both AOL and Airmail accounts. The users should withhold the ransom, at a minimum, until after testing every other solution for restoring their files, and may note that there is a paid decryption service for this family.

Backing up your work onto other devices will best protect it from the Scarab-X3 Ransomware, which can delete local ones securely. Besides the issue of brute-forcing logins, file-locking Trojans circulate through torrents, e-mail attachments, and, more rarely lately, exploit kits running through your Web browser. Most anti-malware products should block these drive-by-downloads and delete the Scarab-X3 Ransomware at any point.

The difficulty of harmful encryption is a genie-out-of-the-bottle situation. While it's an easy to block content, even without the owner's consent, decrypting it is a wealth-oriented enterprise for Trojans like the Scarab-X3 Ransomware.