Pulpy is a .NET ransomware family for Windows, active since around the start of 2018 and detected by Microsoft as Rasoon. Its builds add .aes to every file and leave a note called Instruction.txt in the folders they touch; the 2018 build also mailed the victim's IP address, computer name and file counts back to the attackers. Files are locked with AES, and the key is sealed with an RSA key the attackers hold, so recovery without them is not on record. Because .aes is shared by many unrelated strains, match the note's wording and contact details rather than the extension. Later builds keep the same note name and extension but change the contacts and, in 2023, add a data theft threat. Member page: Pulpy 2023.
Sources: Trend Micro
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161