Makop ransomware

Makop is a Phobos-derived strain seen since 2020. It appends an ID, a contact and .makop to each file and places readme-warning.txt in every affected folder and on the desktop. It skips the Windows directory and files already hit by other ransomware. Operators brute-force RDP, then use network scanners, privilege-escalation exploits, vulnerable drivers and credential dumpers before encrypting. GuLoader has delivered it in some cases. No leak site has been reported.

Sources: In-house research

File extensions: .makop, .mkp, .vassago, .mkp (also appends filenames with victim's unique ID and developers' email address), .baal (files are also appended with a unique ID and the cyber criminals' email address), .captcha, .CARLOS, .datah, .DORRA, .factfull, .fair, .FIOI, .fireee, .gamigin, .harmagedon, .help, .hinduism, .insom (files are also appended with a unique ID and the attackers' email), .INT, .LUCKY (files are also appended with a unique ID and cyber criminals' email address), .makop (also appends filenames with victim's unique ID and developers' email address), .niko, .noctua, .phmqdw, .Raf (files are also appended with a unique ID and the cyber criminals' email address), .rajah (files are also appended with a unique ID and the cyber criminals' email), .read, .reload, .session, .shootout, .snick, .SRC, .stolen, bot, dark, KJHslgjkjdfg, mammon, moloch, razer, usagoo

Ransom note filenames: +README-WARNING+.txt, readme-warning.txt, readme-warning.html, readme.txt

Contact addresses: akzhq00705[@]protonmail[.]com, companyblast[@]msgsafe[.]io, decryption[@]msgden[.]com, esupport[@]privatemail[.]com, hopeandhonest[@]smime[.]ninja, steaknshake[@]gmx[.]us, akzhq1010[@]cock[.]li, akzhq1010[@]tutanota[.]com, akzhq725[@]tutanota[.]com, coleman[.]dec[@]tutanota[.]com, lauracc[@]msgsafe[.]io, moloch_helpdesk[@]protonmail[.]ch, moloch_helpdesk[@]tutanota[.]com, akzhq615[@]protonmail[.]com, akzhq808[@]tutanota[.]com, Evilminded[@]privatemail[.]com, 1527436515[@]qq[.]com, admcphel[@]protonmail[.]ch, akzhq12[@]cock[.]li, akzhq412[@]aol[.]com, akzhq530[@]protonmail[.]com, akzhq710[@]protonmail[.]com, akzhq830[@]tutanota[.]com, akzhq915[@]airmail[.]cc, akzhq915[@]protonmail[.]ch, akzhq915[@]tutanota[.]com, alexpetrov11094[@]gmail[.]com, antiransomware[@]aol[.]com, apollo55[@]lenta[.]ru, apollo55supp[@]protonmail[.]com, backup_499[@]protonmail[.]com, backup1950[@]msgsafe[.]io, btcsupport[@]bingzone[.]net, btcsupport[@]cock[.]li, buydecryptor[@]aol[.]com, buydecryptor[@]cock[.]li, checkfilelock[@]protonmail[.]ch, cloudfiles[@]airmail[.]cc, cloudfiles[@]msgsafe[.]io, cock89558[@]cock[.]li, colemandec[@]tutanota[.]com, compromised[@]airmail[.]cc, crypt[@]qbmail[.]biz, crypt[@]zimbabwe[.]su, darknet[@]techmail[.]info, data[.]compromised[@]protonmail[.]com, datalost[@]foxmail[.]com, daviderichardo[@]messagesafe[.]io, daviderichardo[@]tutanota[.]com, davidrecovery[@]protonmail[.]com, decryption[@]techmail[.]info, dino_rans[@]protonmail[.]ch, dino[@]rape[.]lol, dweezells[@]airmail[.]cc, encryptboys[@]tutanota[.]com, farik1[@]protonmail[.]com, filerecov3ry[@]keemail[.]me, genfiles[@]protonmail[.]com, getdataback[@]qbmail[.]biz, giantt1[@]protonmail[.]com, goldenmark[@]yahooweb[.]co, goodhack[@]privatemail[.]com, greenreed007[@]qq[.]com, grhoster-123[@]tutanota[.]com, hello2021ola[@]protonmail[.]com, helpdesk_makp[@]protonmail[.]ch, honestandhope[@]qq[.]com, ideapad[@]privatemail[.]com, irisaneby[@]aol[.]com, jackydonovan[@]protonmail[.]com, joshua_antony[@]aol[.]com, killyouass[@]protonmail[.]com, kobihornegushersamuels[@]protonmail[.]com, lock59[@]airmail[.]cc, loyaldecrypt[@]privatemail[.]com, loyaldecrzpt[@]aol[.]com, luntik2316[@]protonmail[.]com, mak_supp[@]aol[.]com, mak_supp[@]hotmail[.]com, makop[.]support[@]secmail[.]pro, makop[@]airmail[.]cc, makop[@]keemail[.]me, makop[@]outlookpro[.]net, makop[@]rape[.]lol, makop[@]tuta[.]io, makopfiles[@]aol[.]com, makopransom[@]outlook[.]com, makopsupp[@]tutanota[.]com, manage[.]file[@]messagesafe[.]io, mariany[@]msgden[.]net, MikeyMaus77[@]protomail[.]com, modeturbo[@]aol[.]com, moncler[@]cock[.]li, mondezir[@]mailfence[.]com, morrith_smith[@]tutanota[.]com, mozgpitona[@]outlook[.]com, mrdjohni[@]tutanota[.]com, myfiles[@]msgsafe[.]io, myfilesdecrypt[@]cock[.]li, mymakopfile[@]tutanota[.]com, norahghnq[@]gmx[.]com, paybackformistake[@]qq[.]com, payfordecoder[@]hotmail[.]com, payforkey[@]cock[.]li, paymantsystem[@]cock[.]li, pecunia0318[@]goat[.]si, phillipdyercostarican[@]tutanota[.]com, playerplaya[@]protonmail[.]com, poyasecur[@]gmail[.]com, poyasecurity[@]protonmail[.]com, prndssdnrp[@]mail[.]fr, ranbarron88[@]qq[.]com, restoring[.]data[@]protonmail[.]com, ruthlessencry[@]qq[.]com, savedata2[@]protonmail[.]com, saveisos[@]aol[.]com, shikotan[@]happygoluckyclub[.]com, sirketverileri[@]protonmail[.]com, synchronized[@]gmx[.]com, synchronized[@]msgsafe[.]io, tomasrich2020[@]aol[.]com, undergrounda[@]lenta[.]ru, ustedesfil[@]safeswiss[.]com, ustedesfil[@]tuta[.]io, verilerimialmakistiyorum[@]inbox[.]ru, viginare[@]aol[.]com, votrefile[@]tuta[.]io, willettamoffat[@]yahoo[.]com, ww6666[@]protonmail[.]com, xaodecrypt[@]protonmail[.]com, xiaojunye[@]tutanota[.]com, yamer2[@]protonmail[.]com, yourdataonline[@]aliyun[.]com, yourfriendz[@]keemail[.]me, yourfriendz[@]secmail[.]pro, yourfriendz[@]techmail[.]info, back2datten[@]tutanota[.]com, back2restore[@]neomailbox[.]ch, idemitsu122[@]cyberfear[.]com, mammon0503[@]protonmail[.]com, Nergontr96[@]cyberfear[.]com, pecunia0318[@]tutanota[.]com, rast[@]airmail[.]cc, vassago_0213[@]tutanota[.]com, vassago0213[@]airmail[.]cc, alpoint[@]privatemail[.]com, andysupp[@]keemail[.]me, andysupp[@]onionmail[.]org, andysupp[@]techmail[.]info, ardellchadwick275[@]msgsafe[.]io, back2up[@]swismail[.]com, backvondatten[@]msgden[.]net, barabarabere22[@]outlook[.]com, biden[@]onionmail[.]com, conkichinmodl[@]conkichinmodl[.]com, conkichinmodl[@]gmx[.]com, databack2[@]msgsafe[.]io, databack2[@]tutanota[.]com, datapro[@]decoymail[.]com, datastore[@]cyberfear[.]com, decrypt_your_files[@]outlook[.]com, decrypt24[@]nerdmail[.]co, decryptor[@]cock[.]lu, dekrypt24[@]tutanota[.]com, emcrypts[@]msgsafe[.]io, emcrypts[@]tuta[.]io, emcryptsupport[@]msgsafe[.]io, emonster[@]msgsafe[.]io, emonster[@]onionmail[.]org, gamigin0612[@]tutanota[.]com, gowrite[@]airmail[.]cc, harman[@]privatemail[.]com, help[.]encryptor[@]gmail[.]com, help777[@]messageden[.]net, helpemeantonio[@]gmail[.]com, helprequest[@]techmail[.]info, hope2honest[@]aol[.]com, hpsupport[@]cyberfear[.]com, icq-is-firefox20[@]ctemplar[.]com, justiceinfo[@]disroot[.]org, keydecryptcomp[@]outlook[.]com, localfix[@]waifu[.]club, lucas[.]tid[@]inbox[.]lv, lucas[.]tid[@]tuta[.]io, mainsupport[@]msgsafe[.]io, mainsupport[@]onionmail[.]org, makopmanager[@]msgsafe[.]io, makopmanager[@]tutanota[.]com, mkpdec[@]hotmail[.]com, mkpdec[@]outlook[.]com, molodoi_admen[@]outlook[.]com, monahardecryption[@]airmail[.]cc, mpfile_dec[@]tutanota[.]com, mpfiledec[@]msgsafe[.]io, myfile[@]waifu[.]club, onejoshuasmith[@]aol[.]com, oscar94char[@]mailfence[.]com, oscar94char[@]tutanota[.]com, oslapisavkusna[@]onionmail[.]org, payforkeysbtc[@]aol[.]com, payforkeysbtc[@]hotmail[.]com, please_decrypt_me[@]outlook[.]com, recoveryadmin[@]msgsafe[.]io, rustymckenzie[@]tutanota[.]com, shadow-ds[@]tutanota[.]com, steaknshake[@]stealthypost[.]net, supportid[@]techmail[.]info, telegramfirefox2029[@]protonmail[.]com, torres[@]proxy[.]tg, torresproxytg[@]proton[.]me, trebaler[@]goat[.]si, tsupport[@]privatemail[.]com, vassago_0203[@]tutanota[.]com, vassago0203[@]cock[.]li, vodaigaz[@]outlook[.]com, wecanhelp[@]outlookpro[.]net, wewannahelp[@]proton[.]me, wewillhelp[@]msgden[.]com, akzhq725[@]cock[.]li, agares_helpdesk[@]tutanota[.]com, akzhq808[@]cock[.]li, ammon0503[@]tutanota[.]com, baal0625[@]goat[.]si, bot_elite[@]proton[.]me, carlosrestore2020[@]aol[.]com, datahelper[@]onionmail[.]org, decrypt2023[@]outlook[.]com, decryption[@]zimbabwe[.]su, dorradocry[@]outlook[.]com, element444[@]keemail[.]me, elitebot[@]msgden[.]net, factfull0103[@]airmail[.]cc, fairexchange[@]qq[.]com, gammaga[@]keemail[.]me, gammaga[@]mailfence[.]com, garantos[@]mailfence[.]com, getmydata[@]inbox[.]ru, givebackdata[@]mail[.]ru, gudixaxa[@]yahooweb[.]co, harmagedon0707[@]airmail[.]cc, help24dec[@]aol[.]com, help24dec[@]cyberfear[.]com, helpdesk220222[@]tutanota[.]com, helpforyou[@]firemail[.]cc, insomnia1986[@]tutanota[.]com, insomrans[@]outlook[.]com, integra2022[@]tutanota[.]com, johnlennoncr[@]hotmail[.]com, lergsm[@]onionmail[.]com, lergsm[@]tutanota[.]com, makop25[@]protonmail[.]com, marbas0630[@]tutanota[.]com, MyFile[@]waifu[.]clu, noctua0302[@]goat[.]si, pecunia0318[@]protonmail[.]ch, proof3200[@]proton[.]me, rajah[@]airmail[.]cc, razer1115[@]goat[.]si, readdecoding[@]outlook[.]com, reload2024[@]outlook[.]com, restoreBackup[@]cock[.]li, revilsupport[@]privatemail[.]com, samsung00700[@]tutanota[.]com, snick0222[@]goat[.]si, tuzadiea[@]msgsafe[.]io, vassago0225[@]airmail[.]cc, vassago0225[@]cock[.]li, vassago0225[@]tutanota[.]com, wewillrestoreyou[@]cyberfear[.]com, wewillrestoreyou[@]onionmail[.]org, zimbabwe[@]msgsafe[.]io

Tox handles: 26332F26451645768179C771CA87A7F0F4E234DA8D882888F505494925DCF274A3EA555, B99CB0C13B44E2A1AEBAEB28E70371D6E3DB35DA801721930B53B0E787433270665DA610BAB0

Decryptor: Decryptor availability has not been recorded.

Data exfiltration risk: Medium — Steals file archives and SQL database backups before AES/RSA encryption of local drives and network shares.

Systems typically targeted: SMBs via exposed and brute-forced Remote Desktop Protocol connections.

Do this first: Disable open RDP port 3389 on external firewalls, enforce account-lockout policies, and isolate infected database (SQL) host servers.

From the ransom note +README-WARNING+.txt:

All your files are locked! The lock key on your device is unique! Don't try to unlock the files yourself, you will damage them! To solve the problem, you need to contact us at the provided mail rast[@]airmail[.]cc Guaranteed to solve the problem - unlock one of your files! […]