Whole is a later build of the Keylock ransomware for Windows. It adds .whole after the original name, so 1.jpg turns into 1.jpg.whole, swaps the desktop wallpaper for a message pointing to its text file, and drops a note whose name begins README-ID- followed by a per-victim ID and .txt. The note claims the decryption key sits on the attackers' server, offers a free test on a few files, and gives pmmx[@]techmail.info and wholekey[@]mailfence.com as contact addresses. It is aimed at businesses: unless the victim gets in touch within 72 hours, it threatens to leak or sell company data, and it warns that renaming files or running recovery or security software will make them unrecoverable. Isolate the machine, preserve both the locked files and the ransom note, and treat the leak threat as a possible data breach. For the earlier build see the Keylock page.
Sources: In-house research
File extensions: .whole
Ransom note filenames: README-ID-[victim's_ID].txt
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-30.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161