GlobeImposter is a Windows ransomware family, active since 2016, that copied the look of the older Globe kit. The original build appends .crypt and leaves HOW_OPEN_FILES.hta in each affected folder. GlobeImposter 2.0, from 2017 on, uses hundreds of extensions, including ..doc, and embeds a victim ID in each file. The original version can be unlocked with the free GlobeImposter Decryptor from Emsisoft. Spam with JavaScript inside archives was its main early delivery route. No data theft or leak site is tied to the family. It is a separate code base from Globe despite the copied notes and extensions.
File extensions: obz, keversen, xls, .crypt, .Suffering, .([email protected]), .[[email protected]], .[[email protected]].LotR, .[[email protected]], .[[email protected]], .{[email protected]}KBK, .247_dennisthehitman (number nay vary based on ransomware variant), .247_haroldsquarepants, .726, .777, .ad, .Apollon865, .Athena865, .badday, .C4H, .CC1H, .CC4H, .CCHH, .crypted_monkserenen@tvstar_com, .E-A-C, .ERROR, .FastWind, .forcelock, .foSTE, .GameCrypt
Ransom note filenames: how_to_back_files.html, HOW_TO_BACK_FILES.txt, how_to_back_files.hta, Read Me!.hTa
Decryptor: A decryptor exists but covers only some builds.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161