MinlWon is ransomware that appends .IP to encrypted files, turning report.docx into report.docx.IP. When it finishes it drops a demand named LeadMe.txt and replaces the desktop wallpaper. The note asks for only five US dollars and warns that third-party recovery tools could make files unrecoverable. The tiny demand suggests a test or hobby build. No delivery method, lineage or data theft has been published for it.
Sources: In-house research
File extensions: .IP
Ransom note filenames: LeadMe.txt
Decryptor: We checked the public decryptor listings on 2026-10-26 and could not confirm whether one exists.
Data exfiltration risk: Undocumented — The only write-up describes encryption and a small ransom; nothing indicates data theft.
Systems typically targeted: Windows computers
Do this first: Keep LeadMe.txt and an encrypted sample before changing anything.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161