FAST is a Windows ransomware strain first catalogued in mid-2023. It encrypts files and renames each one so the original name is followed by the operator email address, a victim ID and the .FAST suffix. A text note named #FILEENCRYPTED.txt is left on the desktop. It is a commodity strain aimed at individual Windows machines. No theft of data is documented, and it is not linked to a leak site or a larger ransomware family. A later, unrelated strain called FastLock also appends .FAST but drops a different note, Fast-Instructions.txt.
Sources: In-house research
File extensions: .FAST (files are also appended with the cyber criminals' email and a unique ID)
Ransom note filenames: #FILEENCRYPTED.txt
Contact addresses: azadi3[@]outlookpro[.]net, fastdec[@]tutanota[.]com
Decryptor: Decryptor availability has not been recorded.
From the ransom note #FILEENCRYPTED.txt:
ATTENTION! At the moment, your system is not protected. We can fix itand restore files. To get started, send a file to decrypt trial. You can trust us after opening the test file. To restore the system write to both: fastdec[@]tutanota[.]com and azadi3[@]outlookpro[.]net Your Decryption ID: -
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161