Mammon ransomware

Mammon is the name carried by an August 2024 build of Enmity, Windows ransomware that combines AES-256-GCM with RSA-4096. Each file gets a tag holding a contact mailbox and a victim ID and then .lock, in the form .Mail-[ email ]ID-[ ID ].lock, and the note is READ.txt, listing a Telegram contact and mammoncomltd[@]gmail[.]com. Large files are encrypted twice. Key material goes into a C:\RSADecryptKey folder with files such as KEY.DAT and ID.DAT, so leave that folder alone during cleanup. A later build appends .aaabbbccc after an email-and-ID tag and leaves howtoDecrypt.txt. It is not the older, unrelated strain that used a .mammon extension.

Sources: ID Ransomware

File extensions: .aaabbbccc

Ransom note filenames: howtoDecrypt.txt

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.