Szymekk Ransomware

The Szymekk Ransomware is a file-locking Trojan and a variant of the Cobra Locker Ransomware (or Cobra_Locker Ransomware). The Szymekk Ransomware can block the user's media files with its encryption and create a screen-blocking pop-up window with its ransom demands. For protection, users should save backups to traditionally-secure locations for recovery and let reliable PC security solutions block or remove the Szymekk Ransomware.

The Next Threatening Name on a Blocked Monitor

With one of its last variants being a Stephen King-inspired movie ripoff (the IT Ransomware), the Cobra Locker Ransomware family is one of the smallest Trojan groups still accurately describable as such. However, a threat actor is taking advantage of the pre-fab encryption features for making a personalized campaign, much like the months-old IT Ransomware. The Szymekk Ransomware uses a much more toned-down theme that's more reminiscent of a Ransomware-as-a-Service than the colorful cinematic aspirations of its recent kin.

Malware researchers confirm that the Szymekk Ransomware remains just as adept at blocking files, using the standard encryption features in Cobra Locker Ransomware for targeting media, such as pictures and documents. Although it omits any text files as ransom notes, malware researchers find that this update leverages the screen-locking pop-up to good effect. Its message recommends writing to the campaign's disposable e-mail for 'further instructions,' with no details like a price for unlocking files. It also uses a skull and crossbones logo (similarly to some RaaSes like the Dharma Ransomware).

There is no known, free decryption solution to Cobra Locker Ransomware or, by extension, offshoots like IT Ransomware or the Szymekk Ransomware. Since paying the ransom entails other risks, users with files of any value should save backups of them to a secure device. As general guidelines, malware experts recommend detachable drives or cloud-based services with password protection as preferable means of sparing digital media from encryption-based sabotage.

Taking the Sting Out of a Trojan's Update

The Szymekk Ransomware is a .NET Framework Trojan that only endangers Windows PCs. If necessary, users may circumvent the pop-up that blocks their interface by restarting in Safe Mode, booting to another OS, or using a USB recovery device. Unfortunately, encryption is a more complicated and often impossible – problem to solve, even in well-understood threats like the Cobra Locker Ransomware family.

Because unlocking files isn't always a possibility, users should concentrate on preventing the Szymekk Ransomware infections. Samples of the Trojan aren't using digital signatures, and most security products should detect these corrupted executable files. General precautions like avoiding weak passwords, rejecting illicit downloads, and being careful about enabling threatening features like Flash and macros retain high relevancy against most file-locking Trojans.

Since most security services can accurately flag this threat, users should also feel comfortable removing the Szymekk Ransomware without needing a 'hands-on' or manual approach.

Small-time Trojans don't need an entire Ransomware-as-a-Service for harming users' files. With bit players like the Szymekk Ransomware, the value of a backup doesn't diminish, and those forgetting that might pay with data – or more money than is palatable.