Fabiansomware is an August 2016 variant of the Apocalypse ransomware. The operators renamed it to taunt the head of a malware lab that kept breaking their code, and put a contact address in his name in the note to shift blame. Files are renamed with .encrypted, and a ransom note is written next to each file by adding .How_To_Decrypt.txt to its name. Emsisoft publishes a free Fabiansomware decryptor. Like the rest of the Apocalypse family, it was installed on Windows servers after attackers guessed weak Remote Desktop passwords. It is not known to steal files. It has no link to the REvil (Sodinokibi) operation or to the Fabian Society.
Sources: In-house research
File extensions: .encrypted
Ransom note filenames: .How_To_Decrypt.txt
Decryptor: A decryptor exists but covers only some builds. Checked 2026-11-05.
Scope: Emsisoft's decryptor covers files renamed to .encrypted with *.How_To_Decrypt_Your_Files.txt notes. It needs an encrypted file and its unencrypted original, and it can only decrypt files up to the size of that pair. Files larger than the largest available pair cannot be recovered with it.
Link to decryptor: Emsisoft
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161