Enigma ransomware

Enigma is a Windows ransomware first spotted in late April 2016 and aimed at Russian speakers. It appends .enigma, so test.jpg becomes test.jpg.enigma, and fills the desktop with its own files: the Russian note enigma_encr.txt, an enigma.hta pop-up registered to show the note at every Windows start, a list of encrypted files called allfilefinds.dat, and a key file named ENIGMA_[ID].RSA that the victim must upload to sign in to the onion payment portal. The note claims AES-128 and asks for about 0.43 BTC, roughly $200 at the time. The name has no link to any company called Enigma. It arrives as an HTML email attachment whose embedded JavaScript writes out a script posing as a business registration certificate, which then builds and runs the executable. It tries to wipe shadow copies, but that step sometimes fails, so check Previous Versions before anything else. No data theft is documented. A second version from October 2016 uses .1txt, the note enigma_info.txt and a key file E_N_I_G_M_A.RSA.

Sources: BleepingComputer, ID Ransomware

File extensions: .1txt, .enigma

Ransom note filenames: E_N_I_G_M_A.txt, enigma_encr.txt, enigma_info.txt, enigma.html, HOW_TO_DECRYPT.txt

Decryptor: Decryptor availability has not been recorded.

Data exfiltration risk: Low — Enigma is a legacy endpoint file-locker with no double-extortion leak infrastructure.

Systems typically targeted: Local user directories and accessible mapped drive volumes.

Do this first: Sever network access and terminate the payload, then restore from uninfected backups.

From the ransom note enigma_info.txt:

Мы зашифровали важные файлы на вашем компьютере: документы, базы данных, фото, видео, ключи. Файлы зашифрованны алгоритмом AES 128(hxxps[://]ru.wikipedia[.]org/wiki/Advanced_Encryption_Standard) с приватным ключем,который знаем только мы. Зашифрованные файлы имеют расширение .ENIGMA. Расшифровать файлы без приватного ключа НЕВОЗМОЖНО. Если хотите получить файлы обратно: […]