Ransomware Robin Hood

The Robin Hood ransomware has been active for many years, the first appearance was recorded in 2017, and since then there are numerous records of attacks and updates made on the malware.

During these years there were a few times when there were interruptions in the attacks, but the group always returned with attacks. And now at the end of this year, the group has returned with the attacks, perhaps because of the end of year festivities. Holidays and weekends are commonly used by cybercriminals to carry out attacks.

Robin Hood unlike other ransomware groups does not move laterally through a company’s network, instead after it has invaded a computer it disables all system shares with the company network, thus isolating the affected computer. The group attacks computers individually.

Apart from isolating the computer from the network, the malware stops 181 Windows services, including Windows Automatic Repair. After interrupting all services the ransomware starts the encryption process, after finishing the process a message “Have fun buddy :)))” is left. And the ransom note with instructions for the victim to contact the group is fixed on the desktop.

One of the best backups against a ransomware attack, besides protections such as antivirus, is backup. But the problem is that not all companies have a backup routine or have their backups online, ransomware groups have invested in developing for the malware to search for such backups.

Therefore, it is necessary to have offline and up-to-date backups. But in case, there are no such backups, the assistance of a company specializing in ransomware encrypted data recovery will be necessary.

Recover Files Encrypted by Robin Hood Ransomware

Digital Recovery is used to acting in critical scenarios, we can recover encrypted data without the need for the decryption key.

For more than two decades we have invested in the development of technologies suitable for data recovery. With this we were able to develop the Tracer, a technology capable of recovering virtually all enterprise data storage devices such as Databases, RAID Systems, Storages, Virtual Machines, and others.

Contact us and start the recovery process right now.

We are always online

Please fill out the form, or select your preferred contact method. We will contact you to start recovering your files.

Latest insights from our experts

Descriptografar ransomware em servidores

Decrypt Server

Ransomware attacks on servers have become a growing threat, compromising the security of critical data and business operations. This article explores the nuances of file


Through unique technologies Digital Recovery can bring back encrypted data on any storage device, offering remote solutions anywhere in the world.