BIG HEAD ransomware

BIG HEAD (also written Big Head) is a .NET ransomware family for Windows that surfaced in May 2023. It hides encryption behind a fake Windows update screen. Builds differ in how they mark files: one appends .poop after encrypting with AES, while another overwrites each filename with a Base64 string, so 1.jpg becomes something like Mi5wbmc=. The note is a text file named README_ plus a number, and the desktop wallpaper is replaced. The note claims files were encrypted and leaked and tells victims to write to poop69news[@]gmail.com with their personal ID. The family deletes shadow copies, disables Windows recovery and kills database, mail and office processes before it runs. Big Head goes after consumers and small offices rather than corporate networks, reaching them through malvertising that poses as Windows updates and Word installers. One build adds a Telegram bot that lets the operator take screenshots and send messages, and it collects system details and browsing history, so data on the PC should be treated as exposed. A third build bundles the Neshta file infector, which plants code in other programs on the disk. No leak site is linked to the strain. All three builds share the same contact email and point to a single developer testing different approaches.

Sources: In-house research

Ransom note filenames: README_[random_number].txt

Decryptor: Decryptor availability has not been recorded.

Data exfiltration risk: Likely — The note says files were both encrypted and leaked, and one Big Head build also gathers browser history, running processes, product keys and screenshots from the PC. No leak site or published victim data is tied to the strain.

Systems typically targeted: Home and small-office Windows PCs. Builds arrive as fake Windows updates or fake Word installers pushed through malicious ads, and one build also spreads by copying itself to removable drives.

Do this first: Big Head deletes shadow copies and disables Windows recovery, so check for backups held off the machine rather than relying on restore points. One build carries a Telegram-controlled backdoor and another infects other executables with a file infector, so wipe and reinstall rather than cleaning in place. Change passwords saved in the browser from a separate, clean device.

From the ransom note README_[random_number].txt:

Hello! All your files have been encrypted & leaked... BY BIG HEAD RANSOMWARE Your personal Id: - To decrypt your files you need write to email: poop69news[@]gmail[.]com In the letter, send your personal Id Do not try restore files without our help, this is useless, and can destroy you data permanetly. However, the files can be recovered even after the removal of our program and even after […]