GlobeImposter ransomware

GlobeImposter is a Windows ransomware family, active since 2016, that copied the look of the older Globe kit. The original build appends .crypt and leaves HOW_OPEN_FILES.hta in each affected folder. GlobeImposter 2.0, from 2017 on, uses hundreds of extensions, including ..doc, and embeds a victim ID in each file. The original version can be unlocked with the free GlobeImposter Decryptor from Emsisoft. Spam with JavaScript inside archives was its main early delivery route. No data theft or leak site has been reported. It is a separate code base from Globe despite the copied notes and extensions.

Sources: Emsisoft

File extensions: .crypt, .Suffering, .(hupstore[@]keemail[.]me), .[Bomani[@]Email[.]CoM], .[Merlen[@]Keemail[.]Me], .[new_wave[@]tuta[.]io].LotR, .[sill[@]tuta[.]io], .[Zfile[@]Tuta[.]Io], .{Killback[@]protonmail[.]com}KBK, .247_dennisthehitman (number nay vary based on ransomware variant), .247_haroldsquarepants, .726, .777, .ad, .Apollon865, .Athena865, .badday, .C4H, .CC1H, .CC4H, .CCHH, .crypted_monkserenen@tvstar_com, .E-A-C, .ERROR, .FastWind, .forcelock, .foSTE, .GameCrypt, .globeimposter, .happychoose, .KENS[@]TUTA[.]IO, .locker, .luboversova148, .nacugunder, .Ox4444, .pants, .PIG865QQ, .schrodingercat, .SECURE, .sickfile, .tanos, .Tiger865qq, .xxx, ".dcom, Alpha865qqz, CHAK2, doc, Globeimposter-Alpha865qqz, keversen, mlock2, obz, ReadInstructions, xls

Ransom note filenames: how_to_back_files.html, HOW_TO_BACK_FILES.txt, how_to_back_files.hta, Read Me!.hTa

Contact addresses: China[.]Helper[@]aol[.]com, sin_eater.666[@]aol[.]com, solution247days[@]outlook[.]com, wehavesolution[@]onionmail[.]org, yourdatahelp[@]seznam[.]cz, anoss[@]protonmail[.]ch, bad[.]jerry[@]aol[.]com, badjerry[@]cock[.]li, BlackMajor[@]protonmail[.]com, bomani[@]email[.]com, bucksbanny[@]mail[.]ee, bucksbannyb[@]aol[.]com, chinarecoverycompany[@]airmail[.]cc, chinarecoverycompany[@]cock[.]li, cryptomans77[@]outlook[.]com, decodoperator1.1[@]aol[.]com, decodoperator1[@]aol[.]com, decrypttos[@]cock[.]li, decrypttos[@]protonmail[.]com, doctorhelperss[@]gmail[.]com, edteamoperation[@]protonmail[.]com, fastwindglobe[@]cock[.]li, fastwindGlobe[@]mail[.]ee, fostecrypt[@]aol[.]com, Golddeep[@]proton[.]me, gustafkeach[@]tohaveandtohold[.]us, happychoose[@]cock[.]li, happychoose2[@]cock[.]li, Helper[@]aol[.]com, Helper[@]india[.]com, helpersdoctor[@]outlook[.]com, hupstore[@]protonmail[.]com, jbomani[@]protonmail[.]com, keygetter[@]email[.]cz, Killback[@]protonmail[.]com, lord_bomani[@]keemail[.]me, luboversova148[@]outlook[.]com, Merlen[@]Dr[.]Com, Merlen[@]Keemail[.]Me, Merlens[@]Protonmail[.]Com, monkserenen[@]tvstar[.]com, mr_chack[@]aol[.]com, mr_chack33[@]india[.]com, new_wave[@]tuta[.]io, newwave[@]airmail[.]cc, redteamoperation[@]seznam[.]cz, restoreassistance[@]decorous[.]cyo, restoreassistance[@]wholeness[.]bus, sill[@]tuta[.]io, sills[@]protonmail[.]ch, spysecurelab[@]airmail[.]cc, StuardRitchi[@]tutanota[.]com, SwaqLtd[@]protonmail[.]com, techwin[@]post[.]cz, valakas[@]cock[.]li

Payment wallets: 359rxgpG79V9px1nFLCRyXKQZKixPGcoRp

Tox handles: CA04B61C320C50D12A2C1B95B5062474B5C00B995B588D0B3781DC052CBF9A354CD10F96C84D

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-29.

Scope: Emsisoft's free GlobeImposter decryptor (December 2016) is for the original build only, which appends `.crypt`, keeps the base filename and drops a `HOW_OPEN_FILES.hta` note; it needs an encrypted file plus an unencrypted copy of that same file. GlobeImposter 2.0 files, with their many other extensions and embedded IDs, are not covered.

Data exfiltration risk: Medium — GlobeImposter is a commodity family spread via RDP and spam. There is no core double-extortion leak site, though manual file theft during dwell time is possible.

Systems typically targeted: Local storage, mapped network shares and attached backup repositories.

Do this first: Isolate affected machines, then kill the malicious HTML launcher and secure RDP endpoints.

From the ransom note RECOVER-FILES-726.html:

Your files are Encrypted! ***** For data recovery needs decryptor. If you want to buy a decryptor, click the button Yes, I want to buy Free decryption as guarantee. Before paying you can send us 1 file for free decryption. To send a message or file use this link. ( If you send a file for free decryption, also send file RECOVER-FILES.HTML ) […]

Link to decryptor: Emsisoft