TeamDarkAnon is a small file-encrypting ransomware that appends .anon to each locked file, so 1.jpg becomes 1.jpg.anon. It changes the desktop wallpaper and drops a text note named read_it.txt telling the victim to reach the operator through a Telegram account to get Bitcoin payment instructions, with a decryptor promised after payment. It is known only from a submitted sample, so its targets, delivery route and lineage are not documented, and nothing published shows it stealing data.
Sources: In-house research
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-26.
Data exfiltration risk: Undocumented — The only source describes encryption, a wallpaper change and a payment note, with no reported data theft.
Systems typically targeted: Windows computers
Do this first: Isolate the machine and keep read_it.txt plus one .anon file before attempting any cleanup.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161