MalasLocker is a new ransomware group that emerged in March 2023 and targets vulnerabilities on Zimbra servers. The group uses Age encryption, which is an uncommon encryption technique developed by Filippo Valsorda, a renowned cryptographer.
The ransom note left by MalasLocker demands an unusual ransom: instead of a monetary payment, victims are requested to donate to any of the approved non-profit charities and send the confirmation email to the attackers for verification purposes. Also, the hacker group manifesto claims that they do not attack Latin American countries.
The group has compiled a list of 169 victims whom they categorized as “Defaulters” and threatens to leak the data if the demands are not met. MalasLocker seems to choose victims randomly, and there is no evidence that their decryption “service” is safe to use.
FAQ: If it’s for charity, is it safe to follow the instructions in the ransom note to get the data decrypted?
While forcing victims to donate money to non-profits may seem like a charitable Robin Hood-esque modus operandi, complying with the threat actor’s demands carries the same risks as any other ransomware: there’s no guarantee of a successful decryption or that data won’t be leaked, ransomware attacks are still criminal and complying to their demands does support their activities, there are still potential legal implications and ethical considerations.
SalvageData experts recommend proactive data security measures, such as regular backups, strong cybersecurity practices, and keeping software up to date, to protect against ransomware attacks. And, in case of a MalasLocker ransomware attack, contact our ransomware recovery experts immediately.
MalasLocker is ransomware, which is a type of malware that encrypts and locks the victims’ files and then requests a ransom in exchange for the decryption key.
The group gains access to servers by sending phishing emails with malicious JSP documents to the users of Zimbra. Once the server is breached, MalasLocker encrypts the data using AGE encryption.
AGE encryption is a modern file encryption tool that was developed by Filippo Valsorda, a renowned cryptographer and Go security lead at Google. Overall, Age encryption is a simple, modern, and secure file encryption tool that provides a means to protect sensitive data from unauthorized access. MalasLocker using AGE encryption is unusual since ransomware usually uses a mix of symmetric and asymmetric encryption algorithms.
Confirmed Name
Threat Type
Encrypted Files Extension
Ransom Demanding Message
Is There a Free Decryptor Available?
No, MalasLocker ransomware does not have a decryptor
Detection Names
Ransomware family, type & variant
Distribution methods
Consequences
MalasLocker demands a donation to a non-profit charity of their choice on the ransom note. This unusual ransom gave MalasLocker actors the moniker of “Robin Hood”. However, victims of MalasLocker should not fall for their pretenses of charity since there’s no evidence they actually donated the ransom. Donating to the non-profit charities demanded by MalasLocker ransomware carries certain risks, including lack of guarantee, supporting criminal activities, potential legal implications, data leakage, and ethical considerations.
The ransom note provides the email address of the attacker or a TOR site link showing the most recent email address to contact the attackers. It also threatens to leak the data if the demands are not met.
This is a sample of the MalasLocker ransom note:
MalasLocker ransomware infects a system by breaching Zimbra servers. Victims have reported finding suspicious JSP files on infected servers. It is believed that MalasLocker targets Zimbra servers through phishing emails, where malicious JSP documents are sent to the users of Zimbra.
Once the system is compromised, MalasLocker encrypts emails and files using the Age encryption tool. Age encryption utilizes advanced algorithms such as X25519 (ECDH curve), ChaCha20-Poly1305, and HMAC-SHA2562. This encryption method is rarely utilized by ransomware operations, making MalasLocker unique in its approachIt is important to note that MalasLocker specifically targets non-Windows systems, such as Zimbra servers. The group presents itself as a “hacktivist” ransomware variant, aiming to exfiltrate sensitive emails and encrypt files. However, there is no evidence to support the safety or effectiveness of their decryption “service”.
Contacting a ransomware removal service can not only restore your files but also remove any potential threat.
Important: The first step after identifying MalasLocker IOCs is to resort to your Incident Response Plan (IRP). Ideally, you have an Incident Response Retainer (IRR) with a trusted team of professionals that can be contacted 24/7/365, and they can take immediate action that will prevent data loss and help you through any legal liabilities.
To the best of our knowledge with the information we have at the time this article is published, the first step that a team of ransomware recovery experts would take is to isolate the infected computer by removing any connected device.
Simultaneously this team will assist you in contacting your country’s local authorities. In the case of US residents and businesses, it is the local FBI field office and the Internet Crime Complaint Centre (IC3).
To report a ransomware attack you must gather every information you can about it, including:
However, if you prefer to contact professionals, then do nothing. Leave every infected machine the way it’s and ask for an emergency ransomware removal service. Restarting or shutting down the system may compromise the recovery service. Capturing the RAM of a live system may help get the encryption key, and catching a dropper file, i.e. file executing the malicious payload, might be reverse-engineered and lead to decryption of the data or understanding how it operates.
However, if you don’t have an IRP or IRR, you can still contact ransomware removal and recovery professionals. This is the best course of action and greatly increases the chances of successfully removing the ransomware, restoring the data, and preventing future attacks. We recommend that you leave every infected machine as they are and call an emergency ransomware recovery service.
A Cyber Incident Response is the process of responding to and managing a cybersecurity incident. An Incident Response Retainer is a service agreement with a cybersecurity provider that allows organizations to get external help with cybersecurity incidents. It provides organizations with a structured form of expertise and support through a security partner, enabling them to respond quickly and effectively in the event of a cyber incident.
An incident response retainer offers peace of mind to organizations, offering expert support before and in the aftermath of a cybersecurity incident. The specific nature and structure of an incident response retainer will vary according to the provider and the organization’s requirements. A good incident response retainer should be robust but flexible, providing proven services to enhance an organization’s long-term security posture.
If you contact your IR service provider, then they will take care of everything else. However, if you decide to remove the ransomware and recover the files with your IT team, then you can follow the next steps.
You can identify which ransomware infected your machine by the file extension (some ransomware uses the file extension as their name), using a ransomware ID tool, or it will be on the ransom note. With this information, you can look for a public decryption key.
You can also check the ransomware type by its IOCs. Indicators of Compromise (IOCs) are digital clues that cybersecurity professionals use to identify system compromises and malicious activities within a network or IT environment. They are essentially digital versions of evidence left at a crime scene, and potential IOCs include unusual network traffic, privileged user logins from foreign countries, strange DNS requests, system file changes, and more. When an IOC is detected, security teams evaluate possible threats or validate its authenticity. IOCs also provide evidence of what an attacker had access to if they did infiltrate the network.
Before recovering your data, you must guarantee that your device is ransomware-free and that the attackers can’t make a new attack through exploit kits or other vulnerabilities. A ransomware removal service can delete the ransomware, create a forensics document for investigation, eliminate vulnerabilities, and recover your data.
Backups are the most efficient way to recover data. Make sure to keep daily or weekly backups, depending on your data usage.
If you don’t have a backup or need help removing the ransomware and eliminating vulnerabilities, you should contact a data recovery service. Complying with the demands of threat actors does not guarantee your data will be returned to you. The only guaranteed way you can restore every file is if you have a backup of it. If you don’t, ransomware data recovery services can help you decrypt and recover the files.
SalvageData experts can safely restore your files and prevent MalasLocker ransomware from attacking your network again.
Contact our experts 24/7 for emergency recovery service.
Preventing ransomware is the best solution for data security. is easier and cheaper than recovering from them. MalasLocker ransomware can cost your business’s future and even close its doors.
These are a few tips to ensure you can avoid ransomware attacks:
Recovery mode is a crucial feature for troubleshooting and restoring an iPad when it encounters…
Whether you’re a professional juggling important work documents or an individual cherishing irreplaceable memories, safeguarding…
It's not uncommon to encounter issues where an external drive is not showing up on…
When restoring your iPhone from a backup, you may discover it is corrupted or incomplete.…
Backup and remote wiping procedures are two critical components of data security and management for…
VMware is a leading virtualization and cloud computing software provider. Its core technology allows multiple…