Usr0 is a Windows file-encrypting ransomware first logged in early 2017. It renames locked files with a suffix matching its name and leaves a Russian-language text note on the desktop telling the victim to email a victim number to the operator at usr0[@]riseup[.]net. The note targets Russian-speaking users and asks for a payment in Bitcoin. It is unrelated to CryptXXX, Locky or the 2016 San Francisco transit attack. No data theft or leak site has been reported.
Sources: In-house research
File extensions: .usr0
Contact addresses: usr0[@]riseup[.]net
Decryptor: Decryptor availability has not been recorded.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161