7ev3n-HONE$T is a 2016 edition of the 7ev3n ransomware for Windows, named for its new offer to decrypt a few test files before payment. Unlike the first edition it does not lock the whole desktop: its ransom window cannot be closed, but other programs still run. The price fell from 13 bitcoins to 1 BTC, or 0.5 in some samples, with discounts for paying in full or for buying back half the files. Encryption runs offline; most files end in .R5A, as before, while a random selection get .R4A and a different cipher. A text file with contact details and a victim ID is also dropped in case the window fails to appear. Keep that note, since free decoders for several samples need the ID, and for some the file's original path. The first edition has its own page, 7ev3n.
Sources: Malwarebytes
File extensions: .R4A
Decryptor: A decryptor is reported to exist, but we do not link to it. Checked 2026-10-30.
Scope: Free GUI and Python decoders cover only specific 7ev3n samples; match the ransom note to the examples given. Depending on the sample they need the victim ID from the note, the file's original path, or both.
Sources: 7ev3n decoders by hasherezade
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161