Reynolds is a Windows ransomware strain that adds .locked to encrypted files and leaves a text file whose name is wrapped in triple underscores. The note is brief, gives a three-day window to make contact and supplies a qTox identifier it calls a poison ID, alongside a Tor portal. Its distinguishing trait is a bundled vulnerable kernel driver, loaded from the payload itself, used to terminate security processes before encryption begins. Observed victims are organisations, and the note threatens a repeat attack and publication of files if the deadline is missed.
File extensions: .locked
Ransom note filenames: ___RestoreYourFiles___.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161