777 Ransomware Encrypts Victims' Data

While examining new file samples, our team came across a ransomware dubbed 777, which is affiliated with the GlobeImposter ransomware family.

Upon execution, the malware proceeded to encrypt files and appended a ".777" extension to their filenames. For example, a file named "1.jpg" would become "1.jpg.777", while "2.png" would be transformed into "2.png.777". Subsequently, a ransom note titled "how_to_back_files.html" was generated.

The ransomware's message, attributed to 777 (GlobeImposter), notifies the victim that their files have been encrypted and underscores the necessity of a decryption tool, which is held by the attackers.

Instructions are provided for the victim to contact the cybercriminals and submit an encrypted text or image file for decryption verification. Following this step, the attackers will provide guidance on the payment process for the decryptor.

The note warns against actions that may result in permanent data loss, including removing the ransomware, running security software, and attempting manual decryption. Additionally, the victim is cautioned that recovery tools used by other victims are not compatible with this particular infection and are therefore not interchangeable.

777 Ransom Note Promises Decryption of One File

The complete text of the 777 ransom note reads as follows:

YOUR PERSONAL ID

ENGLISH
YOUR FILES ARE ENCRYPTED!
ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED.

To recover data you need decryptor.
To get the decryptor you should:

Send 1 test image or text file decodoperator1@aol.com,decodoperator1.1@aol.com.
In the letter include your personal ID (look at the beginning of this document).

We will give you the decrypted file and assign the price for decryption all files

After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.
Attention!

Only decodoperator1@aol.com,decodoperator1.1@aol.com can decrypt your files
Don't trust anyone except decodoperator1@aol.com,decodoperator1.1@aol.com
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders other users are not compatible with your data, because each user's unique encryption key

How Can You Best Protect Your Data Against Ransomware Attacks?

Protecting your data against ransomware attacks requires a combination of preventive measures and proactive strategies. Here are some best practices:

Regularly Back Up Your Data: Ensure that your data is regularly backed up and stored securely. This includes both local backups and off-site or cloud backups. Regularly test your backups to ensure they can be successfully restored in case of an attack.

Keep Software Updated: Regularly update your operating system, software applications, and antivirus programs to patch known vulnerabilities. Cybercriminals often exploit outdated software to deploy ransomware.

Implement Security Software: Install reputable antivirus and anti-malware software on all devices and keep them updated. Consider using endpoint detection and response (EDR) solutions that can detect and respond to ransomware threats in real-time.

Enable Firewall Protection: Use a firewall to monitor and control incoming and outgoing network traffic. This can help prevent unauthorized access to your network and block malicious activities.

Use Strong Authentication: Implement multi-factor authentication (MFA) or strong password policies to prevent unauthorized access to your systems and accounts.

Limit User Privileges: Restrict user privileges to only the necessary level required to perform their job functions. This can help minimize the impact of a ransomware infection by limiting the ability of the malware to spread laterally across your network.

Monitor Network Activity: Implement network monitoring tools to detect unusual or suspicious activity on your network. This can help identify potential ransomware infections at an early stage and prevent further damage.