Zoneware Ransomware

The Zoneware Ransomware is a file-locking Trojan that holds media, such as videos or pictures, hostage by encrypting it. Con artists often follow these attacks by providing instructions asking you to pay Bitcoins or other currencies for their decryptor software, which this threat may display through both pop-ups and text messages. Affected users should have anti-malware products disinfecting their PCs and uninstalling the Zoneware Ransomware, to prevent any further damage, before using any free recovery data-recovering options, as appropriate.

Into the Extortion Zone

A new, file-locking Trojan's campaign is just beginning as of late September, with its threat actor using unknown system-infecting strategies to hold hostage documents and other content on the PC. For the time being, malware experts have yet to confirm whether the Zoneware Ransomware is an independent threat or a member of a previous family, such as Hidden Tear or the Jigsaw Ransomware. However, the chances are high that the Zoneware Ransomware is at least partially built using components of these old Trojans.

The Zoneware Ransomware (or the '.ZW Extension' Virus) is a Trojan that uses encryption to encode and lock different formats of files, potentially ranging from documents and spreadsheets to larger data types, such as video and archives. Besides adding '.ZW' extensions to the names of these files and blocking them from opening, the Zoneware Ransomware also may create other symptoms. Malware experts note that the most likely and high-visibility of these behaviors include:

• The Zoneware Ransomware may reset your desktop's wallpaper to a new image; typically, the new picture will be a generic encryption warning or an extension of the Trojan's ransoming demands (see below).
• This threat also may create both text documents and Web pop-ups, including HTA-formatted ones with interactive content, which deliver payment demands for unlocking your files. Live countdowns, crypto currency-based transaction options, warnings about the possible deletion of your files, and fake legal notifications all are traditional accompaniments of these attacks.
• In addition to keeping you from opening certain types of media, the Zoneware Ransomware also may block different applications, including the Task Manager, Regedit, or some brands of anti-virus software.

When Your Files are the Wares of a Trojan's Storefront

Although this Trojan's development may see further updates to its encryption method, any information that the Zoneware Ransomware locks may be suitable for decrypting by third-party applications. Any users who can't restore their content with backups should consider copying their enciphered media and ascertaining the compatibility of all public decryptors suitable for decoding this threat's payload. For users more interested in other restoration strategies, malware experts advise keeping backups on secure devices that the Zoneware Ransomware can't compromise.

Spam emails are the highest-trafficked vector for the distribution of all file-locking threats, this year. Besides disguising itself as part of an email attachment or link, the Zoneware Ransomware also may be installing through such exploits as corrupted website scripts, misnamed torrents, or abuses of RDP features. Any users who update their anti-malware programs when prompted should detect and delete the Zoneware Ransomware before it has an opportunity to damage any of their files. For halting ongoing encryption issues, all infected PCs should have sharp limitations in their contacts with other PCs, storage devices or the Internet until after you've removed the Zoneware Ransomware with appropriate security products.

Since malware experts have yet to verify which targets the Zoneware Ransomware is attacking, all users should consider themselves at risk for this campaign equally, until further notice. Turning files into captives for profit is a modern variant of a hostage-taking scenario that can afflict either global businesses or the everyday user while making money from both of them.