Ranion ransomware has drawn attention on dark web forums for its low sale price. The group operates with RaaS (Ransomware as a Service) tactics.
The group has offered free trials to its buyers, after which they are charged prices of 0.95 Bitcoin/year ($960/year) or 0.6 Bitcoin/6 months ($605/6 months).
This easy access to a powerful ransomware like Ranion is extremely worrying, because attacks that would be done by a few people, can be done by hundreds of people around the world.
Ranion is distributed through spam email campaigns, trojans, malicious links, and more. It acts like other ransomware, after invading the victim’s system the defense systems are disabled and it starts mapping the files that will be encrypted.
All encrypted files receive the extension .ranion, such files cannot be accessed or altered, the files can only be accessed through the decryption key.
After the encryption process is completed, a text file is generated with the ransom term, as well as a link to the group’s site for the victim to start negotiating with the criminals.
The payment of the ransom is not recommended under any circumstances, the payment funds the groups for further attacks, and the criminals do not give any guarantee that the key will be delivered after payment.
Recover files encrypted by Ranion ransomware
Digital Recovery specializes in the recovery of data encrypted by ransomware in Databases, Storages, Virtual Machines, RAID Systems, Servers and others.
Our unique solutions allow us to recover encrypted files without the need for the decryption key that is held by hackers, it is worth remembering that we do not negotiate with criminals.
Our processes are customized to fit the real needs of each client, we know that information about hacker attacks are extremely sensitive, to guarantee the secrecy of the information we developed our NDA (confidentiality agreement) that we make available to all our clients.
We can recover files remotely, without the need to send encrypted media to our lab. The recovery is done in a totally secure virtual environment.
Contact us and start the recovery now.