Ransomware Robm

Robm ransomware is part of the Djvu/STOP ransomware quartel, which is one of the ransomware with the most variants. The cartel is responsible for hundreds of attacks around the world.

Like members of the Djvu family, Robm uses AES-256 encryption. This algorithm generates only one decryption key, it is unique and if it is deleted the files cannot be recovered by hackers.

Criminals use this as blackmail to pressure the victim to pay the ransom, but there are options to payment, which are the solutions developed by Digital Recovery to recover data encrypted by ransomware, even without a decryption key.

Robm ransomware has numerous tactics to break into the victim’s system, but, the most used are spam email campaigns, links on free online hosting sites among others.

All files affected by ransomware are assigned the .robm extension, making them inaccessible to the user and can only be accessed with the decryption key or with the help of Digital Recovery.

After the encryption process is completed, a text file named “_readme.txt” is generated. In it the group leaves the necessary information for the victim to contact the group to make the ransom payment.

The group uses two e-mails for communication: “restorealldata@firemail.cc” and “gorentos@bitmessage.ch”.

There is no guarantee that the decryption key will be released after the payment of the ransom, criminals do not care about your data, they only care about the money. Therefore, look for companies that can help you recover files without having to pay a ransom to the criminals.