STOP/DJVU Ransomware

DJVU ransomware, also known as STOP, has elevated its attacks since early 2022. It first appeared in 2018 and since then there have been more than 370 variations of the malware.

STOP/DJVU uses RSA encryption, which is one of the most commonly used by ransomware groups, the group’s main focus is Windows operating systems.

Because there are so many variations of STOP/DJVU, the extensions added to the encrypted files are varied, the main ones include: .eucy, .ckae, .qnty, . ccps, .iips, .avyu, .cuag, .bbbr, .bbbe, .qqqr, .maiv, .bbbw, .yoqs, .qqqe, .qqqw, .maak, .fhkf, .vfgj, .yber, .zaqi, .nqhd, .vgkf, .dehd, .loov among others.

After STOP/DJVU invades the system it automatically downloads various programs that assist the ransomware to encrypt all files without any interruption.

At the end of the encryption a text file is left with instructions for the victim to contact the group to pay the ransom.