Exotic ransomware

Exotic is a Windows ransomware strain released in October 2016 by an author using the names EvilTwin and Exotic Squad. It encrypts files with AES-128, renames them to random strings and adds the .exotic extension, so test.jpg may become 87as.exotic. No note file is dropped. Two windows take its place: the first warns not to kill the program, and the second asks for $50 in bitcoin within 72 hours and threatens to format the hard drive on restart. Three builds came out within days; the first two showed a picture of Hitler and the third used a screen locker in the style of Jigsaw. It hits single Windows PCs and works through the Desktop, Downloads, Pictures, Music, Videos and the rest of the user profile. Unlike most strains it also locks executables, which breaks programs kept in those folders. No stolen data is claimed and there is no leak site. No link to another family has been shown.

Sources: In-house research

File extensions: .exotic

Decryptor: No public decryptor was found. Checked 2026-10-13.

Data exfiltration risk: Undocumented — The Exotic screens ask for a small bitcoin payment and make no claim of stolen data. No theft is tied to it and it has no leak site.

Systems typically targeted: Windows PCs. It locks files under the user profile, including executables, so downloaded programs stop working too.

Do this first: Exotic threatens to format the drive on restart, so take a disk image or copy the encrypted files off before rebooting. It also encrypts executables in the user profile, so reinstall programs rather than trusting copies kept there. Restore data from backups made before the infection.