Makop is a Phobos-derived strain seen since 2020. It appends an ID, a contact and .makop to each file and places readme-warning.txt in every affected folder and on the desktop. It skips the Windows directory and files already hit by other ransomware. Operators brute-force RDP, then use network scanners, privilege-escalation exploits, vulnerable drivers and credential dumpers before encrypting. GuLoader has delivered it in some cases. No leak site is tied to it.
File extensions: makop, .makop, .mkp, mkp, .vassago, .mkp (also appends filenames with victim's unique ID and developers' email address), gamigin, moloch, .baal (files are also appended with a unique ID and the cyber criminals' email address), .captcha, .CARLOS, .datah, .DORRA, .factfull, .fair, .FIOI, .fireee, .gamigin, .harmagedon, .help, .hinduism, .insom (files are also appended with a unique ID and the attackers' email), .INT, .LUCKY (files are also appended with a unique ID and cyber criminals' email address), .makop (also appends filenames with victim's unique ID and developers' email address), .niko, .noctua, .phmqdw, .Raf (files are also appended with a unique ID and the cyber criminals' email address), .rajah (files are also appended with a unique ID and the cyber criminals' email)
Ransom note filenames: +README-WARNING+.txt, readme-warning.txt, readme-warning.html, readme.txt
Decryptor: Decryptor availability has not been recorded.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161