GopherWare is a Windows ransomware first recorded in May 2025 that adds .gph to the names of the files it encrypts and sets a replacement desktop wallpaper image, with a text message left once it completes. It is a separate strain from the 2021 Go-based Gopher locker, which uses a different extension and has its own page. Little else about its demand or operators has been documented; disconnect the affected computer, keep the encrypted files and any note, and restore from offline backups instead of paying.
Sources: In-house research
File extensions: .gph
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161