RRansom is a family of small Windows file lockers seen from 2021. The base form adds _encrypted straight onto file names, with no dot, writes README_encrypted.txt, and asks the victim to send the metadata.bin file left in the user folder to a Tor payment site, quoting 1,000 USD or one Monero. Some notes claim X25519 and ChaCha20 encryption. Other builds swap in their own extension, note name and a much smaller demand. No data theft is claimed by the family. Member page: Canadian RRansom.
Sources: In-house research
File extensions: _encrypted
Ransom note filenames: README_encrypted.txt
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161