This page covers a 2023 build of the Pulpy ransomware family (also tracked as ShiOne and Rasoon), a .NET encryptor that combines AES-256 for files with RSA-2048 for the key. It appends .aes to each name, so taxes.pdf is left as taxes.pdf.aes, and writes Instruction.txt, the same note name and extension seen in earlier Pulpy builds since 2018. Because .aes is used by many unrelated strains, the note text and its Tox and email contacts matter more than the extension. The note speaks to a business: it says the infrastructure was hit, that databases and documents were copied out of the network, and that waiting more than 24 hours to open negotiations will cost the victim, with leaking as the implied penalty. Nobody has linked a leak site to this build, so the theft claim is unverified but should be planned for.
Sources: ID Ransomware
File extensions: .aes
Ransom note filenames: Instruction.txt
Decryptor: Decryptor availability has not been recorded.
From the ransom note Instruction.txt:
Hello. I SULINFORMATICA. Your infrastructure has been hit and all files are encrypted. Be warned - this is complex multi-threaded encryption. All your files are intact, they will be fully accessible after decryption. All important files/documents/databases have been downloaded from your network. They are securely hidden and stored in order to further work with your company data. We suggest that you start negotiations […]
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161