You can eliminate the Black KingDom ransomware from the Exchange server by following the methods discussed below and avoid further encryption. Steps to Eliminate and Prevent Black KingDom Ransomware Attack However, you should never pay or meet any ransom demands, as users often do not receive the promised decryption key or tool. The Bitcoin address 1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FThas received a total of 0.17300000 BTC ($9,154.35) on March 18. The ransom note demands either 0.052 or 0.19 Bitcoin (equivalent to $500/ $10,000) as payment for decryption key that (according to the attackers) can help victims recover their data.
DEMON extension to the encrypted filenames with a ransom note named decrypt_file.TxT or ReadMe.txt. The threat actors are now using the ransomware to target and attack the vulnerable Exchange servers.īlack KingDom ransomware encrypts the files on the compromised Exchange servers and adds a. Earlier, it was used to attack corporate networks using Pulse VPN. Black KingDom Ransomware – How it Worksīlack KingDom ransomware, also known as DemonWare or GAmmAWare, was first detected in February 2020. In this post, we discuss about the Black KingDom ransomware, ways to safeguard your Exchange server against such malicious attacks, and methods to recover Exchange server after such attacks. Steps to Eliminate and Prevent Black KingDom Ransomware Attackīlack KingDom is a ransomware variant, which targets on-premises Exchange servers that are not updated and are exposed to ProxyLogon vulnerabilities.Black KingDom Ransomware – How it Works.
0 kommentar(er)
