NoCry ransomware

NoCry is a Windows ransomware builder seen since 2021, and builds made with it rename each encrypted file by adding .Cry after the original extension; a later build uses .recry. When it finishes, it swaps the desktop wallpaper, opens a pop-up with a countdown and a Bitcoin demand, and leaves How To Decrypt My Files.html as a written copy of the instructions. Because anyone with the builder can change the extension, note and contact details, a file that does not match this exact pattern may still come from a NoCry build. Cut the machine off from other devices, save a copy of the note alongside the locked data, and recover from backups rather than paying. GhosHacker was produced with this builder, and research ties the AzzaSec encryptor to the same NoCry lineage; both have separate pages.

Sources: WatchGuard, WatchGuard

File extensions: .Cry, .recry

Ransom note filenames: How To Decrypt My Files.html

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.