List of Known Ransomware File Extensions

When discussing ransomware and its destructive capabilities, understanding the role of file extensions is crucial. File extensions are the suffixes at the end of file names, like .docx for Word documents or .jpg for images, which help both users and their operating systems determine the type of content stored in each file. This system of identification plays a pivotal role in the functionality of many software applications, which rely on file extensions to process data appropriately.

In the context of ransomware attacks, these file extensions take on a more sinister role. Ransomware, by its nature, seeks to infiltrate systems, encrypt files, and demand a ransom to restore access to the affected data. One of the hallmarks of such an attack is the alteration of the file extensions. This change serves multiple purposes: it signals to the victim that their files are no longer accessible in their original form, acts as a psychological tool to create urgency and fear, and prevents regular software from recognizing and opening these files.

Understanding File Extensions

Typically, users recognize file extensions as standard indicators of what software will open a particular file. For instance, .pdf files open with Adobe Reader or another PDF viewer. However, when ransomware infects a system, it renames these files using unusual or unknown extensions, thus severing the association between the file and its corresponding application. This is a key disruption tactic, rendering files useless unless the extension is either restored to its original state or the file is decrypted using a key controlled by the attackers.

Common Ransomware File Extensions

Ransomware developers often use specific, recognizable file extensions to tag encrypted files. They are not just random choices; they are deliberately selected to instill recognition and fear. Each ransomware strain might use a different set of extensions, which can sometimes even hint at the type of ransomware involved, thereby assisting cybersecurity professionals in identifying the specific malware and possibly countering it more effectively.

Below is a list of known ransomware variants and their file extensions:

Ransomware Name	Description	File Extension
Abyss Ransomware	Mostly targets corporate networks as compared to individual personal systems.	.ABYSS
Akira Ransomware	Has been targeting organisations with ransoms in the hundreds of thousands and into the millions.	.akira
Alpha Ransomware	Operational strategy includes the use of a DLS titled “MYDATA” on the Dark Web, indicating a methodical approach to victim data leakage.	Random 8-character alphanumeric
Avaddon Ransomware	Uses RaaS, encrypts files, also acts as leakware, known for DDoS threats.	.avdn
Black Turtle Ransomware	While primarily targeting enterprises, it can also occasionally compromise individual personal systems.	a string including HELLO or HELP + numbers
BlackCat Ransomware	Targets large companies, known for sophisticated attacks on infrastructure.	.blackcat
BlackMatter Ransomware	High-profile ransom demands, shut down in 2021.	.blackmatter
BlackSuit Ransomware	Known to target corporate entities and demand high ransoms, often in the millions of dollars range.	.hydra
BO Team Ransomware	Primarily targets large corporations and governmental organizations, inflicting maximum financial and reputational damage.	.newbot
Clop Ransomware	Hits high-profile targets, uses sophisticated exploits.	.clop
Conti Ransomware	Widespread RaaS, uses deceptive emails often masked in documents.	.conti
Dharma Ransomware	Known as CrySIS, targets through RDP and email.	.dharma
Electronic Ransomware	A unique ID is assigned to each victim, and this ID, along with the cybercriminals’ email address, is appended to the filenames.	.ELCTRONIC
Elibe Ransomware	Elibe ransomware was discovered during an investigation of new submissions to the VirusTotal website.	.elibe
GlobeImposter 2.0 Ransomware	Propagates through malicious JavaScript, pirated content sites.	.crypt
Haron Ransomware	Spin-off from Avaddon, focuses on data extortion.	.haron
Hive Ransomware	Targets vulnerable servers, aggressive against healthcare.	.hive
Lethal Lock Ransomware	Known to modify the Windows registry entries to gain persistence and launch its encrypting module every time the system starts.	.lethal
Lockbit Ransomware	RaaS and leakware, incentivizes insider attacks.	.lockbit
MAKOP Ransomware	Claims false data theft, lesser-known.	.makop
Matrix Ransomware	Uses RDP for access, customizes ransom demands.	.matrix
Meow Ransomware	Primarily targets misconfigured and unsecured databases exposed on the internet.	.MEOW
New Live Team Ransomware	The ransom demanded by the criminals is typically paid in Bitcoin.	newlive.team
New Ran Ransomware	Primarily targets businesses and organizations rather than individual personal systems.	.lalo
Night Crow Ransomware	Primarily targets corporations and public entities.	.nightcrow
NoName Ransomware	Targeting NATO member countries that showed solidarity with Ukraine.
Phobos Ransomware	Often targets smaller businesses, spread via spam.	.phobos
Ping Ransomware	Targets a wide range of file types, including pictures, videos, documents, and databases.	.ping
Quantum Ransomware	Known for speed, targets via phishing.	.quantum
Ryuk Ransomware	Linked to WIZARD SPIDER group, targets large organizations.	.ryuk
Schrodingercat Ransomware	Has a predilection for compromising corporate targets over individual users.	Name.pdf.schrodingercat
SNet Ransomware	Commonly spreads through spam and ransomware emails, cracked software, and malicious downloads.	.snet
Sodinokibi Ransomware	Also known as REvil, very widespread, targets various entities.	.revil
Tprc Ransomware	The ransomware employs a dual payload strategy, which not only encrypts victim’s data, but also steals sensitive information.	.tprc
Unkno Ransomware	Has been seen to primarily target government institutions, educational establishments, and businesses.	.unkno
Xam Ransomware	Operates as a Ransomware-as-a-Service (RaaS).	.xam

Conclusion

Understanding the manipulative changes ransomware makes to file extensions is essential for recognizing and mitigating such attacks effectively. By distorting the normal function of files, ransomware exerts control and creates a state of urgency that can devastate businesses and individuals alike.

As leading experts in ransomware and cybersecurity, we provide comprehensive support through our Ransomware Recovery Services, Ransomware Negotiation Services, and Ransomware Settlement Services. If your organization is facing a ransomware crisis or seeking to enhance its cybersecurity framework, do not hesitate to contact us for specialized assistance.