Proxima is Windows ransomware that adds .proxima to each file and leaves Proxima_Readme.txt, with some builds using an HTML note instead. The note says the files were both stolen and encrypted and threatens publication if the victim does not pay, though no leak site has been verified. Treat the theft claim as possible and preserve logs before rebuilding. Member pages: Black Berserk and BTC-Azadi.
Sources: In-house research
File extensions: .proxima
Ransom note filenames: Proxima_Readme.txt
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161