ESCANOR is .NET ransomware for Windows. It adds .ESCANOR to the end of each encrypted file, meaning invoice.pdf is left as invoice.pdf.ESCANOR; its instructions arrive as HELP_DECRYPT_YOUR_FILES.txt, placed on the user desktop. The note sets the price at 980 US dollars in Bitcoin and offers to unlock one file at no charge as proof. The strain is aimed at individual Windows computers, and no business or server campaign has been linked to it. The ransom text is silent on data theft, and no leak site has been reported. No ties to a larger family have been established.
Sources: In-house research
File extensions: .ESCANOR
Ransom note filenames: HELP_DECRYPT_YOUR_FILES.txt
Decryptor: No public decryptor was found. Checked 2026-10-13.
Data exfiltration risk: Undocumented — The ESCANOR note asks only for payment to unlock files and makes no claim of stolen data. No leak site or theft has been tied to this strain.
Systems typically targeted: A .NET build for Windows that encrypts user files and drops its note on the desktop. Nothing points to server, hypervisor or NAS targeting.
Do this first: Copy HELP_DECRYPT_YOUR_FILES.txt and several .ESCANOR files to separate media before any cleanup, since they are needed to identify the build if a recovery method appears later. Check for Volume Shadow Copies and offline backups before reinstalling Windows.
From the ransom note HELP_DECRYPT_YOUR_FILES.txt:
Oops All Of your important files were encrypted Like document pictures videos etc.. Don't worry, you can return all your files! All your files, documents, photos, databases and other important files are encrypted by a strong encryption. How to recover files? […]
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161