Delta Plus encrypts files and appends the ".delta" extension to their filenames (for example, it renames "1.jpg" to "1.jpg.delta", "2.jpg" to "2.jpg.delta"). It also creates the "Help Restore Your Files.txt" text file - a ransom note containing contact and payment information. Screenshot of a
Similar to mutigue.com, apsolutamente.org, haenkyouv.space, mydesktopdefender.com, and many others, tobaitsie[.]com is a rogue webpage that loads questionable content and/or redirects visitors to different (likely untrustworthy or malicious) sites. Users typically enter such websites via redirect
Emails used to trick recipients into providing personal information are disguised as letters from legitimate companies, organizations, or other entities. Most of them contain a website link designed to open a deceptive website. Scammers behind this email attempt to trick recipients into providing
ConnectionCache generates revenue for its developer by displaying advertisements and changing settings web browser's settings (by promoting a fake search engine). This application has the qualities of adware and a browser hijacker. ConnectionCache is distributed through a fake Adobe Flash Player
Churrasqueirataylor[.]com is a deceptive site running various scams. At the time of research, it promoted a scheme targeting iPhone users. The scam aims to trick users into installing a dubious app by claiming that users' devices are infected. Untrustworthy websites are usually accessed through
Mutigue[.]com is a rogue website sharing many similarities with apsolutamente.org, mobsuitem.com, success-news.org, and thousands of others. It is designed to load dubious content and/or redirect visitors to different (likely unreliable or malicious) webpages. Rogue sites are typically entered th
yUixN is part of the Dharma family. It blocks access to files by encrypting them and modifies their filenames by appending the victim's ID, retools@eml.cc email address and the ".yUixN" extension to them. For example, it renames "1.jpg" to "1.jpg.id-C279F237.[retools@eml.cc].yUixN", "2.jpg" to "2.
"Customer Experience Survey" refers to a group of scams that promise fake rewards for survey completion. They are essentially the same, key differences being the supposed organizer of the giveaway and hoax prizes. These schemes aim to trick users into revealing their personal information (phishing
Mugrikees[.]com is an untrustworthy page designed to display deceptive content to trick visitors into allowing it to show notifications and open other shady websites. It is similar to thehomesail[.]com, apsolutamente[.]org, haenkyouv[.]space, and hundreds of other pages. Most users end up on websi
JamesBond is a ransomware-type program. It locks victims' files through encryption and demands payment for the data recovery (decryption). During the encryption process, files are appended with a ".jamesbond2021@tutanotacom_jamesbond" extension. For example, a file named "1.jpg" would appear as "1