The Sugar ransomware differs from the larger ransomware gangs and focuses its attacks on individual computers of ordinary users and small businesses.
The group emerged in November 2021, it is not very clear why the group chose to do small attacks, but the fact that these computers are easier to hack and do not draw as much attention from authorities, may have been one of the motivations.
The group has applied the RaaS (Ransomware as a Service) tactic, which is the outsourcing of attacks by external agents. Attacks on individual computers is easier for people with little or no experience to carry out.
After Sugar invades the system it downloads some files and only after that the encryption is initiated, these files are tools that will assist the encryption process.
The extension .encoded01 will be added to all files affected by the ransomware, none of these files can be opened.
After the process is completed a file named “BackFiles_encoded01.txt” is added to all folders, it will receive the information for the victim to contact the group through the .TOR website.
The ransom amount is not fixed, but is made according to the amount of encrypted data, the group offers to decrypt 5 files for free to convince the victim that they have the decryption key.
In fact, the group has the decryption key, but there is no guarantee that the key will be released after paying the ransom, so do not trust the criminals.
There is solution to recover the files encrypted by ransomware, Digital Recovery has developed such solutions.
Recover Files Encrypted by Sugar Ransomware
Digital Recovery has focused its efforts on developing technologies capable of recovering files encrypted by ransomware of any length and on any storage device.
Our processes are unique and all of them have been developed based on the General Data Protection Regulation (GDPR).
We can recover HDDs, SSD, Database, Servers, Virtual Machines, Storages (NAS, DAS, SAN), RAID Systems and others.
We know how sensitive the information of companies that have been attacked by ransomware is, so we provide all our customers with the confidentiality agreement (NDA), all information about the case is totally confidential.
We can recover data anywhere in the world through remote recovery, so the duration of the process is drastically reduced.
Start advanced diagnostics now. Contact our experts.
