Kirk ransomware

Kirk is a Star Trek-themed Windows ransomware written in Python and found in March 2017. It poses as the Low Orbital Ion Cannon network stress tool, using the file name loic_win32.exe. It encrypts files with AES, protects the key with an embedded RSA-4096 public key and appends .kirked. The encrypted key is saved in a file called pwd next to the executable, along with the note RANSOM_NOTE.txt. The note asks 50 Monero in the first two days, rising in steps to 500 Monero after 15 days, and says the key will be deleted after 31 days. Victims are told to email the pwd file to kirk.help[@]scryptmail.com or kirk.payments[@]scryptmail.com and are promised a decryptor named Spock. It goes after single Windows computers and a long list of game file types. Nothing in the note mentions copied data and no leak site exists. It was one of the first ransomware strains to demand Monero instead of bitcoin.

Sources: In-house research

File extensions: .kirked

Ransom note filenames: RANSOM_NOTE.txt

Contact addresses: kirk[.]help[@]scryptmail[.]com, kirk[.]payments[@]scryptmail[.]com

Decryptor: No public decryptor was found. Checked 2026-10-13.

Data exfiltration risk: Undocumented — The Kirk note asks only for Monero to get a decryptor and says nothing about copied data. No theft or leak site is tied to this strain.

Systems typically targeted: Windows PCs. It goes after several hundred file types, many of them game files, alongside office documents.

Do this first: The pwd file next to the ransomware executable holds the encrypted key, and the note warns that losing it rules out recovery, so do not delete it. Restore data from backups made before the infection.