Has Phobos Ransomware infected your files? If your files and backups are affected, it is critical to your organization. This site provides all the important information about the Phobos ransomware itself, decryption, recovery, removal and statistics. Please review the information below or contact our support team, to get fast help with Phobos ransomware recovery.
The Phobos Encryption is a type of Ransomware Trojan that encrypts the entire PC or individual data. The Ransomware Trojan then asks you to pay a ransom to decrypt your data.
Shut down your computer or server in the usual way and disconnect all network connections immediately, including any data storage devices and online cloud storage. For more details please visit the Ransomware Information site.
Do not pay the ransom or try to remove the Phobos ransomware trojan on your own. It usually plants itself in the startup folders and continues to infect your computer each time it is turned on. You should leave the removal of ransomware and, the subsequent recovery of your valuable company data, exclusively to experts.
BeforeCrypt can help you as a serious and highly-effective partner should you be infected by Phobos ransomware. Thanks to our experience and knowledge, we can recover 100% of your encrypted data in most cases.
The groups that operate Phobos ransomware have been targeting large organizations. As such the ransom amounts have been very high.
The average Phobos ransom amount is somewhere between $5,000–$25,000. In addition, approximately 10% of Bitcoin exchange fees will apply to the use of quick-buy methods such as PayPal or credit card.
- Dharma Ransomware average ransom in USD $
The Phobos ransomware downtime is a bit longer than normal ransomware attacks. The manual process of email-based communication with the attackers can add a considerable delay in the response time.
Depending on your company size and how often you use IT-systems in your daily business, this is the most expensive part of this incident. Additional to the unavailability of your IT-systems, this is damaging your company reputation.
Your goal should be to get your systems back to a productive state as soon as possible. The best way to do this is to call in experts, which have a vast knowledge of Phobos ransomware and get the IT-systems back up running.
- All Ransomware
There is a high chance to get a working Phobos decryptor after paying the attackers. But there’s never a guarantee to get a working decryption key at all.
Depending on the file extension and email address of the attackers, there are different chances of getting a working Phobos decryptor after payment.
Some attackers have a good reputation for providing working Phobos decryptors. Others are known as scammers and will never provide a working decryptor.
- Paid Decryption Successful
- Paid Decryption Failed
The most common attack vector for Phobos ransomware is an unsecured RDP-Connection (Remote Desktop Protocol). Followed up by phishing emails and security vulnerabilities.
- Remote Desktop (RDP)
- Phishing Emails
- Security vulnerabilities
|PHOBOS RANSOMWARE SUMMARY|
|Name||Phobos Virus / Phobos Ransomware|
|Danger level||Very High. Advanced Ransomware which makes system changes and encrypts files|
|Appended file extensions||.acute, .actin, .Acton, .actor, .Acuff, .Acuna, .acute, .adage, .Adair, .Adame, .banhu, .banjo, .Banks, .Banta, .Barak, .Caleb, .Cales, .Caley, .calix, .Calle, .Calum, .Calvo, .deuce, .Dever, .deal, .devil, .Devoe, .Devon, .Devos, .dewar, .eight, .eject, .eking, .Elbie, .elbow, .elder, .phobos, .help, .blend, .bqux, .com, .mamba, .KARLOS, .DDoS, .phoenix, .PLUT, .karma, .bbc, .CAPITAL|
|Ransom note||"Phobos.hta" or "info.txt"|
|Contact email address||[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]|
|Known scammers||1. [email protected]|
This is an average Phobos ransomware note.
All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 000QQQ If there is no response from our mail, you can install the Jabber client and write to us in support of [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/
Almost always, there is a * .txt file in every folder that has been encrypted. The text file usually has the name “info.txt” and contains all the necessary information to contact the Phobos Ransomware attackers to get your data back. It’s usually safe to open this file, just be sure the full file extension is *.txt.
Sometimes the attackers leave the encrypted files without any Phobos ransomware notes. The file name contains a generic and customized ID number and the attackers’ email. This Phobos ID number is always individual, and sometimes there are additional IDs if more than one system got encrypted by Phobos ransomware. The appended file extensions depend on the Phobos ransomware variant.
The most common ones are .acute, .actin, .Acton, .actor, .Acuff, .Acuna, .acute, .adage, .Adair, .Adame, .banhu, .banjo, .Banks, .Banta, .Barak, .Caleb, .Cales, .Caley, .calix, .Calle, .Calum, .Calvo, .deuce, .Dever, .devil, .Devoe, .Devon, .Devos, .dewar, .eight, .eject, .eking, .Elbie, .elbow, .elder, .phobos, .help, .blend, .bqux, .com, .mamba, .KARLOS, .DDoS, .phoenix, .PLUT, .karma, .bbc, .CAPITAL
Depending on the Phobos variant, there are different types of decryptors. Phobos ransomware is based on a 2-way decryption process. You will receive a decryptor executable, mostly called “decryptor.exe”, which first is used to scan the entire computer, network drives, external HDDs and other removable devices. After this scan has finished, you get a “Request code”, this contains the public key request, and it is completely individual for each victim.
This “Request code” is sent over to the attackers, who then generate your decryption keys. The keys generated are unique for each person. A decryption key which you get from another victim, who has already received a Phobos decryption key, will not work for you.
Phobos ransomware creates multiple Windows registry entries, creates hidden executable files and sometimes opens a backdoor in firewalls for further access. There are multiple steps necessary, including the cleaning up of the Windows registry, scanning for malware and the manual cleanup of the Phobos ransomware. Depending on the system environment, it is sometimes safer and faster to reinstall the operating system.
The most common attack vector for Phobos ransomware is an unsecured RDP-Connection (Remote Desktop Protocol). It is followed up by phishing emails and security vulnerabilities.
- We can reduce your downtime from ransomware significantly. We’re dealing with over a hundred cases every year. We know what to do, to keep the downtime for your company to an absolute minimum. You can benefit from our expert knowledge and don’t need to do time-intensive researches by yourself.
- Don’t deal with criminals directly. Most companies don’t feel comfortable dealing with cyber-criminals. It can add a layer of stress in this company-wide emergency. We handle the whole communication with the criminals for you, providing all the necessary information upfront, to restore your data as fast as possible.
- Instant Ransomware Payment. We don’t recommend that you pay the ransom. But sometimes there’s no other way if backups and normal recovery methods fail. If you try to buy Bitcoins yourself, you run through an intensive Know-your-customer process, which usually takes2-6 days, if you try to buy higher amounts of Bitcoins. For this case, we always have Bitcoins in stock and can do an instant-payment for you.
- We don’t damage your data. In every case, we use best-practice methods to back-up your encrypted data first, remove the Ransomware trojan and then restore your data with normal recovery methods or decrypt the data with the official software. This standardized process ensures that your data won’t get damaged and that the ransomware no longer spreads on your network.
- Easy Insurance Reporting: You receive a detailed report and a sample letter, to easily submit this case to your cyber-insurance. Cyber-insurance usually covers a huge part of the costs involved with ransomware incidents.
- Backup, Backup, Backup! Use a separated backup destination like a secure cloud storage provider or a local backup medium, which gets physically disconnected after a successful backup run.
- Install a Next-Gen-Antivirus. It combines a classic signature-based antivirus with powerful exploit protection, ransomware protection and endpoint detection and response (EDR).
- Install a Next-Gen-Firewall. A Next-Gen-Firewall is also called Unified threat management (UTM) firewall. It adds a layer of security at every entry and exit point of your company data communication. It combines classic network security with intrusion detection, intrusion prevention, gateway antivirus, email filtering and many more.