'sebastiennolet92@gmail.com' Ransomware

The 'sebastiennolet92@gmail.com' Ransomware is an update of the MoWare H.F.D Ransomware branch of Hidden Tear. Although Hidden Tear, famously, includes an AES encryption feature for blocking the PC's media files, this branch of the family is buggy, and the 'sebastiennolet92@gmail.com' Ransomware can't cause any damage other than creating pop-up warning tactics. However, users should assume that it's a threat to their PCs and allow an appropriate anti-malware product to remove the 'sebastiennolet92@gmail.com' Ransomware when it's appropriate.

France's Information may Be a Little Less Secure than It Was Yesterday

A threat actor is re-purposing an old, buggy version of Hidden Tear for targeting French speakers, instead of English ones, in a new campaign whose development still is highly incomplete. As a primitive variant of the MoWare H.F.D Ransomware, the 'sebastiennolet92@gmail.com' Ransomware keeps in its possession the hoax-related credentials and warning messages of its ancestor, which could trick its victims into paying ransoms to an 'information security' company. However, just like the MoWare H.F.D Ransomware, the 'sebastiennolet92@gmail.com' Ransomware shows no evidence of damaging the user's files, thanks to bugs.

The glitches in the 'sebastiennolet92@gmail.com' Ransomware and its previous version aren't limited to preventing the included encryption and file-locking routine from running as intended. They also generate runtime errors whenever the Trojan opens. On the other hand, malware researchers do rate the 'sebastiennolet92@gmail.com' Ransomware for being functional, concerning the display of its fake 'Information Security' pop-up.

The HTA (or advanced Web page) pop-up window from the 'sebastiennolet92@gmail.com' Ransomware displays a stripped-down, French version of the MoWare H.F.D Ransomware ransom note, with such elements as a live countdown, a set of ransoming instructions, and the criminal's e-mail address, as any readers can see in the 'sebastiennolet92@gmail.com' Ransomware's name. Many of these elements are incomplete or are using placeholders. Meaningfully, the 'sebastiennolet92@gmail.com' Ransomware also asks for Paysafecard payments instead of Bitcoins, which emphasizes the European-centered nature of its future attacks.

The Data Security that Costs Nothing but a Little Time

Although users may need to remove the extensions that the 'sebastiennolet92@gmail.com' Ransomware can add to any filenames ('.H_F_D_locked'), they shouldn't find it necessary to decrypt or restore their files. The possibility of updates to the 'sebastiennolet92@gmail.com' Ransomware, as well as the encryption-readiness of most versions of Hidden Tear, do, however, make it critical for users to back their work up to appropriately secure devices. Windows OSes do provide default features for resetting lost data via the VSC, but many file-locker Trojans make points of subverting that Windows failsafe and denying the user their localized backups.

Any infection vectors for the 'sebastiennolet92@gmail.com' Ransomware's attacks are speculatory, at this article's date of writing. The frequent abuse of spam e-mails makes it an archetypal point of contact between most PC users and file-locker Trojans from Hidden Tear, the Jigsaw Ransomware, and other families. Weak network logins also can be at risk for brute-forcing and giving criminals a backdoor into a network. Let your anti-malware tools remove the 'sebastiennolet92@gmail.com' Ransomware as they detect it and be careful of scanning any new downloads that don't come from implicitly reputable sources.

The 'sebastiennolet92@gmail.com' Ransomware doesn't offer much of a danger to your documents or archives but is an early warning of what victims its author expects of harvesting ransoms from in the future. French Web surfers and server admins will have a new worry to add to the other, file-locker Trojans, if the 'sebastiennolet92@gmail.com' Ransomware ever finishes its development cycle.

Update

Since late September of 2018, another, French-based variant of the MoWare H.F.D Ransomware is under analysis. The threat actors responsible for its campaign are in the testing phases and, most likely, are releasing this version, the 'sebastiennolet92@gmail.com' Ransomware, for testing their detection rates against the AV industry's security solutions.
 
The 'sebastiennolet92@gmail.com' Ransomware creates a pop-up alert that's almost identical in formatting to the first one. However, the language is French instead of English, with the additional removal or modification of various sentences, along with the inclusion of what is, apparently, a placeholder text. The currency format of the ransom price also changes from Bitcoins to Paysafecard, which places the 'sebastiennolet92@gmail.com' Ransomware's upcoming campaign around Europe. The threat actor also uses a different e-mail for negotiating, as the Trojan's name references.
 
No changes imply that the 'sebastiennolet92@gmail.com' Ransomware is any closer than before to having a file-locking feature, such as encryption, at this time.