Sojusz surfaced in February 2022 and borrows heavily from Makop, Phobos and BigLock. Locked files gain a ten-character victim ID and an operator mailbox in square brackets, then a .sojusz ending, and the demand -----README_WARNING-----.txt asks the victim to email a MachineID and LaunchID. Later builds use other endings, among them .Washedback, which pairs a Skype contact with a #HOW_TO_DECRYPT#.txt note. Files are locked with AES and ChaCha under RSA, and the operators offer to unlock two small files as proof. It can be run by hand during an intrusion, and victims have been reported in several countries. No theft of data is documented.
File extensions: Washedback
Decryptor: Decryptor availability has not been recorded.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161