Vault Ransomware

The Vault Ransomware is a new version of VaultCrypt or CryptVault, a small family of file-locking Trojans. The Vault Ransomware payload coordinates attacks such as encrypting files, delivering ransom notes, and wiping data through additional software like SDelete. A secure, offsite backup is preferable for remedying any damage this Trojan does, although traditional anti-malware programs should identify and remove the Vault Ransomware as a threat.

The Trojan Vault Creaks Open Again

The Russian-victimizing VaultCrypt of 2015 is contaminating new PCs under minor variants, even four years after its debut. The Vault Ransomware is the latest addition to its family, which includes most of the features that malware experts confirmed in XRTN Ransomware previously, one of the few other variants. Besides the old encryption attacks and related pop-ups, the Vault Ransomware could be wielding another feature: new text messages for ransom notes.

The Vault Ransomware is a Windows threat with linguistic preferences for Russian speakers as victims. It uses Gnu Privacy Guard as its means of encrypting media with RSA-1024, which stops files such as Word's DOCs, PDFs and ZIP archives from opening. Although this encryption routine is reasonably secure, the Vault Ransomware also includes more insurance: deleting backups with SDelete.

The Vault Ransomware's family of VaultCrypt is known for its use of pop-up alerts for delivering Russian-language extortion demands. These instructions recommend visiting the threat actor's website and paying Bitcoins of roughly 300 USD value for the unlocker. However, some sources are reporting additional support in the Vault Ransomware of delivering text messages, as well. This extra is not usual for its family but is similar to other ones, such as the Scarab Ransomware, and might be the threat actor's effort of increasing compatibility with more targets.

Closing Up the Vault Ransomware's Encryption Spree

Malware experts are estimating e-mail as being the current infection vector for the Vault Ransomware, although other possibilities, such as torrents or RDP hacking, are equally viable. E-mail attachments or links may pretend that they're providing documentation related to industry news or business finances, and, usually, will abuse document or spreadsheet-embedded macros. Turn off macros, if possible, and update document reader software for closing up vulnerabilities that could invite Trojan installations.

Freeware decryption services for variants of VaultCrypt are not available readily, and the Vault Ransomware deletes most local backup securely. Having additional security on your backups, or storing them on non-accessible devices, is the best means of counteracting any loss of media from harmful encryption. Encryption routines, generally, show few or no symptoms while they're running, although some attacks may include disguises like fake Windows update UIs.

Anti-malware services of most vendors should remove the Vault Ransomware easily since it's a variant of a well-known and analyzed family of Trojans.

As the Vault Ransomware continues abusing White Hat software for Black Hat purposes, PC owners on the wrong side of its payload have few options other than prepping their files for recovery beforehand. Forethought in your media's maintenance always is better than reverse-engineering something as easily-securable as an encryption algorithm