Vulston Ransomware

The Vulston Ransomware is a file-locker Trojan that takes your digital media hostage by encrypting it. Its attacks are recognizable through the extensions that it adds to their names and the unique ransoming messages it creates. Besides backing up your work for its safety, the users can keep their PCs safe by having anti-malware products available for deleting the Vulston Ransomware as soon as they detect it.

The Latest Trojan Variant Bearing the Stamp of the Xorist Ransomware

Trojans made through 'builder' kits for different threat actors' convenience make up a considerable part of the file-locking Trojan industry and are responsible for Ransomware-as-a-Service as a business model. One example in this category is the Xorist Ransomware, who may be responsible for a new set of attacks, coming into the first month of 2019. Although malware experts can't, yet, confirm it, infections by the Vulston Ransomware show cues that are suggestive of many members of that family.

The Vulston Ransomware infections encrypt media using an algorithm that has yet to be verifiable, although XOR and TEA are two of the options that the Xorist Ransomware's family supports. It searches Windows systems for text documents (including PDFs), pictures, or other media formats of potential value and 'locks' them with the encrypting of their data. Besides this standard attack, malware experts also note that labeling of '.vulston' extensions in the names, which has yet to make any appearances in the campaigns of other file-locking Trojans.

Malware experts only see the Vulston Ransomware infections on Linux systems, which is a sharp difference from the Xorist Ransomware's history. However, this pattern doesn't, necessarily, rule out the Vulston Ransomware's being from that group, or 'borrowing' code from it for a financially-independent series of attacks. As with any good, file-locking Trojan, the Vulston Ransomware's attack turns the targeted files unusable until the victim can acquire either a decryption service or recover through some form of backup.

Getting Out of a Criminal's Timekeeping Plans

The Vulston Ransomware infections, besides their data-blocking attacks, also support the creation of ransom notes in a Notepad's native format. The majority of these messages ask for Bitcoin payments within three days to a wallet that malware researchers note is showing signs of what may be a successful extortion-related activity. However, the collecting of such fees doesn't imply that the criminal is giving back a decryptor or unlocking solution, and users should, preferentially, try all other data restoration tactics before paying.

There is a chance that free decryption software can retrieve your data, and the Xorist Ransomware family does have freeware solutions of this nature. However, since such decrypting services are innately risky, malware experts advise keeping backups of your work on separate and secure devices for the long-term safety of your work. As a last line of defense, a high-quality anti-malware program should delete the Vulston Ransomware before its attacks can start, as well.

Either as a new version of an old Trojan business or one that bears a resemblance to that RaaS family, the Vulston Ransomware is equally threatening to your documents, photo galleries and music archives. 2019 is shaping up to be a viable 'business market' for file-locking Trojans, and you should protect yourself from a possible the Vulston Ransomware attack accordingly.