Why Mzqw ransomware is so dangerous

Cybercriminals operating the notorious Djvu/STOP ransomware family continue to release new ransomware versions. Mzqw ransomware is the newest addition. It can be identified by the .mzqw extension added to encrypted files.

Mzqw ransomware encrypts all personal files and demands victims pay money for their recovery. The whole thing is very problematic because even paying the ransom does not always result in decrypted files. Furthermore, there currently is no free Mzqw ransomware decryptor available, so only users who have copies of files saved in backup will be able to recover them for free. Because file recovery is not always possible, Mzqw ransomware is considered to be a particularly dangerous infection.

When initiated on a computer, the ransomware displays a fake Windows update window. This is a distraction tactic used by the ransomware while users’ files are being encrypted. The malicious infection will encrypt all personal files, including all photos, videos, documents, etc. The encrypted files can be identified by the .mzqw extension. Unfortunately, none of the files that have that extension will be openable. To recover those files, a decryptor is necessary. But getting it is not easy.

The ransomware drops a _readme.txt ransom note with information about how victims can buy the decryptor. According to the note, the decryptor costs $980 but victims can get a 50% discount if they contact the cybercriminals within the first 72 hours.

Whether to pay the ransom or not is up to the victims themselves but before making a decision, they should be aware of the risks. The most important thing to mention is that even after paying the ransom, a decryptor will not necessarily be sent to victims. Because the malicious actors are not obligated to help users, they can choose not to. Even with a discount, the ransomware operators are demanding a lot of money so paying is risky.

Unfortunately, there currently is no free Mzqw ransomware decryptor available. Developing one will be difficult for malware researchers because the ransomware encrypts users’ files with unique keys. Without a user’s specific key, a decryptor would not work on their files. So unless those keys get released sometime in the future, a free Mzqw ransomware decryptor is not very likely.

What can users do to avoid malware infections?

There are certain steps that users can take to avoid becoming victims of malware infections. Generally, having good online/browsing habits is very helpful.

Malware can often be found in torrents, especially for popular entertainment content. For example, recently released popular movie torrents are usually full of malware. Even if pirating copyrighted content via torrents was not dangerous, it’s also theft.

One of cybercriminals’ favored methods of malware distribution is emails. Users whose email addresses have been leaked will likely receive emails with attached malware occasionally. Though the emails are fairly simple to identify. One of the most obvious signs is grammar and spelling mistakes in emails whose senders claim to be from legitimate companies. Because many malicious actors have poor English skills, their emails are full of very obvious mistakes.

Cybercriminals also address users using generic words (e.g. User, Member, Customer), which often gives them away. Emails sent by companies to customers will use names to address them because it makes emails seem more personal. But because malicious actors do not have access to personal information, they are forced to use generic terms.

Anti-malware software should be used to delete Mzqw ransomware

Considering that ransomware is a highly sophisticated malware infection, users should remove Mzqw ransomware using anti-virus programs like SpyWarrior or WiperSoft. If users have backup, they can access it as soon as the ransomware is no longer present.

More information about Mzqw ransomware can be found here and here.