SunCrypt ransomware

SunCrypt is a ransomware-as-a-service operation that came to prominence in mid-2020. It renames every encrypted file with a 64-character hexadecimal string that differs from file to file, for example photo.jpg.2A71...DF26, so the extension itself cannot be used to recognise it. The usual note is YOUR_FILES_ARE_ENCRYPTED.HTML, which sends victims to a Tor chat to negotiate and warns that copied business data will be published or passed to competitors if payment is refused. SunCrypt goes after organisations, encrypting local drives and network shares on Windows systems, and is described as a small private programme run by a closed group of affiliates. It was an early user of triple extortion, adding DDoS attacks on victims who stop negotiating to encryption and leak threats. Later builds stop processes and services that hold files open, clear event logs once encryption ends and then delete themselves. Its earliest form, from 2019, was written in Go and used a plain .sun suffix.

Sources: In-house research

File extensions: 4C7154E21822FD5704544AB39F547DCE7CEA7FB820E1875EFC27528D5A751473, 61C6E6754D0122529C7CD433DEF345622F0B4BD5A2C5FC91152E6842A988EA5D, 9.png.8C7D585413C0DF78DD34F1CE556B5A19D44130E4F6753895CA2490717A931D07

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-26.

Data exfiltration risk: Likely — The ransom note says valuable data is copied during each attack, and the operators run a leak site where tracker reporting says the stolen files of one school district were posted.

Systems typically targeted: Windows servers, endpoints and network shares

Do this first: Preserve the YOUR_FILES_ARE_ENCRYPTED.HTML note and the event logs that survive, and treat the incident as a data breach from the start.

From the ransom note YOUR_FILES_ARE_ENCRYPTED.HTML:

If you get this message, your network was hacked! ***** After we gained full access to your servers, we first downloaded a large amount of sensitive data and then encrypted all the data stored on them. That includes personal information on your clients, partners, your personnel, accounting documents, and other crucial files that are necessary for your company to work normally. […]