Fonix ransomware

FonixCrypter, also called Fonix or Xinof, is a Windows ransomware family that ran as a service from June 2020 until January 2021. Encrypted files get a combined suffix of the form .Email=[address]ID=[id].FONIX, and later builds swap the final part for .XINOF, the name spelled backwards. Notes include # How To Decrypt Files #.hta in early builds and How To Decrypt Files.hta plus Help.txt later. The family uses Salsa20 with RSA and deletes shadow copies, the backup catalog and boot recovery settings before encrypting. A free FONIX Decryptor from Bitdefender is listed on No More Ransom, and Kaspersky's Rakhni Decryptor also handles Fonix. Affiliates spread it mainly through spam, so both home users and companies were hit. It encrypted files only and ran no leak site. In late January 2021 the operators announced they were shutting down and published the master private key, which is what made the free decryptors possible.

Sources: In-house research

Decryptor: A free decryptor is available. Checked 2026-10-13.

Data exfiltration risk: Undocumented — Fonix was sold as a service for file encryption only. No source documents data theft or a leak site.

Systems typically targeted: Windows home and business machines, mostly reached through spam. It encrypts nearly every non-system file and deletes shadow copies and the Windows backup catalog.

Do this first: The operators published their master key in January 2021 and free decryptors were built from it, so encrypted data can be recovered without paying. Keep all encrypted files and the notes, remove the malware first, and then run the decryptor on a copy of the data.

Sources: No More Ransom