Scorpio Ransomware

The Scorpio Ransomware is a variation of the Scarab Ransomware, a Trojan that encrypts your files' internal data, modifies their names, and creates notes asking you to pay for its file-unlocking software. Backing up your work to a removable device or other protected storage solution can protect it from these extortion attempts. Malware experts also endorse using any anti-malware program previously capable of dealing with its predecessor for disabling or removing the Scorpio Ransomware.

When Beetles Evolve into Scorpions

Perhaps due to its brand not having the desired level of success, or to don't concentrate all its resources in one place, the Scarab Ransomware already is being split into a secondary campaign under a new name. Although malware analysts are noting that all updates of this new variant, the Scorpio Ransomware, appear to be cosmetic, the Trojan does include all of the previous encryption attacks. As a result, it's just as threatening to a compromised PC's media as the June's Scarab Ransomware.

The clearest difference between the Scorpio Ransomware and its direct ancestor is the '.scorpio' extension that it appends to all of the files it blocks. Additional filename-related changes that the Trojan causes include overwriting it with a Base64-encoded string and the insertion of a bracketed e-mail address. As usual, the latter is for communicating with the Scorpio Ransomware's threat actor for ransom negotiations.

The Scorpio Ransomware still seems to use the same encryption algorithm as the previous Scarab Ransomware. It also reuses the ransom note: a Notepad file that gives the victim an ID number makes false claims about a 'security problem' with the computer and demands Bitcoins for the decryptor that will unlock your media.

The Simple Anti-Venom for Even Simpler Trojans

The Scorpio Ransomware may lack a month's worth of progress, in comparison with its old version, but retains all previous potential for endangering your files with an enciphering attack that may not be reversible. Backing up your content to non-local storage is one of the most comprehensive ways of blocking threats of the Scorpio Ransomware's classification from causing damage that you can't reverse. Since cryptocurrency transfers are at risk of being accepted without the recipient providing any services, making the payments that the Scorpio Ransomware demands is discouraged by malware analysts for any but the direst situations.

Trojans with media-encrypting functionality are notable for using the following distribution strategies, in particular:

• Attaching their Trojan droppers (such as Zlob) to e-mail spam, or embedding vulnerabilities in the attachments that download and launch such as installer.
• Using brute-force tools to 'hack' a server's login credentials, which users may facilitate with bad password choices accidentally.
• Inserting threats like the Scorpio Ransomware into the payloads of exploit kits, which reside on corrupted websites and use software vulnerabilities to launch drive-by-downloads

All of the above, excepting password management, is defensible with most anti-malware products directly. Anti-malware utilities are identifying and removing the Scorpio Ransomware with high rates of success, which remains the best chance for defending any files without backups.

As work on the Scorpio Ransomware and the Scarab Ransomware's small family continues, the individual members may either stagnate or grow more advanced than before. Whether it's the former or the latter that happens, the price of not scheduling your backups is only climbing higher.