M3rx ransomware

M3rx is a Windows ransomware family, written in Go and seen since spring 2026, that leaves a plain-text file named RECOVERY_NOTES.TXT in desktop and documents folders. Encrypted files lose their original names: each is renamed to a 16-character random string followed by a builder-chosen suffix, so the extension is not a dependable marker. The note lays out a numbered negotiation sequence, offers three test decryptions, points to a Tor client portal with a per-victim path and lists a Tox handle for support. Leak-site listings are small in number and spread across the United Kingdom, the United States, Australia and continental Europe, covering property, charity and electronics firms among others. The note claims files were copied out before encryption and threatens both publication and handing data to competitors, although the analysed encryptor itself contains no upload routine. It deletes shadow copies, encrypts only part of each file by default and seals per-file keys with an X25519 operator key.

Ransom note filenames: RECOVERY_NOTES.TXT

Decryptor: No public decryptor was found. Checked 2026-10-14.