EN
DE
Unmasking the Newbie But Not-so-Friendly New Live Team Ransomware
First reported in February 2022, the New Live Team ransomware has quickly established a name for its relentless attacks on corporate systems. Although relatively new, this ransomware variant poses a significant threat, relentlessly encrypting files with a “newlive.team” extension and leaving behind ransom notes known as “README_RECOVER_FILES_INFO.txt” to intimidate its victims. Notably, this ransomware was responsible for an attack on a major European retail company and another incident involving a renowned American logistics firm.
Information on “New Live Team” Ransomware
| Ransomware name(s) | New Live Team |
|---|---|
| When the ransomware was first detected/reported | February 2022 |
| Operating systems affected | Windows |
| Appended file extension | .newlive.team |
| Name of the ransom note | README_RECOVER_FILES_INFO.txt |
| Email address of the group | [email protected] |
| Ransomware group leak site | N/A |
Additional Information
- The New Live Team ransomware is part of the RansomExx/Defray777 ransomware family.
- Currently, no free decryption tool is available to restore the encrypted files.
- The ransom note README_RECOVER_FILES_INFO.txt informs victims about the encryption and directs them to contact the criminals through the provided email.
- The ransom demanded by the criminals is typically paid in Bitcoin.
- The cybercriminals behind this ransomware threaten to publish stolen sensitive data on their leak site if the ransom is not paid.
In conclusion, the emergence of New Live Team ransomware in February 2022 highlights a significant increase in cyber threats, particularly against corporate entities. As part of the RansomExx/Defray777 family, it targets networks, encrypts files, and demands ransom in Bitcoin. Its impact on major businesses in Europe and the U.S. underscores the urgent need for robust cybersecurity measures. Our services, including Ransomware Recovery Services, Ransomware Negotiation Services, and Ransomware Settlement Services, are crucial in helping organizations manage and mitigate these risks. We offer specialized support to navigate the complexities of ransomware incidents, aiming to minimize disruption and strengthen security for future protection.
Related posts
The Emergence of the Crimson Collective Ransomware
Crimson Collective is a newly identified ransomware-related cyber threat group that surfaced around September 2025. While often associated with ransomware-style extortion, the group primarily focuses on large-scale data exfiltration and leverage-based attacks rather than traditional file encryption. Their operations have drawn significant attention following claims of a major breach involving Red Hat, where they allegedly […]
19.03.2026
The Emergence of the Insomnia Ransomware
Insomnia is a newly identified cyber threat operation that surfaced around October 2025, initially appearing as a ransomware-related threat actor, but quickly distinguishing itself through a fundamentally different approach. Unlike traditional ransomware groups, Insomnia does not rely on file encryption or the use of a ransomware file extension. Instead, it focuses exclusively on large-scale data exfiltration and […]
19.03.2026
The Emergence of the Tengu Ransomware
Tengu is a modern ransomware variant that surfaced around October 2025 and has quickly established itself as an active cyber threat across multiple regions. Operating as a Ransomware-as-a-Service (RaaS) model, Tengu enables affiliates to carry out attacks using shared infrastructure and tooling. Once deployed, the malware encrypts victim data and appends the ransomware file extension “.tengu” to affected files, […]
19.03.2026
News Week: March 9th to March 15th, 2026
ClickFix Variant Abuses Windows Terminal to Bypass Security Controls A newly observed ClickFix variant demonstrates how attackers continue refining social engineering techniques to evade detection and increase success rates. Instead of using the traditional Run dialog, victims are instructed to launch Windows Terminal, creating a more trusted environment for executing malicious commands. Once executed, the […]
16.03.2026You are currently viewing a placeholder content from Wistia. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.
More Information