Remove Moscovium ransomware

Moscovium ransomware is malware that encrypts files. It’s a very dangerous piece of malware because it targets personal files and makes them unopenable. Encrypted file names will have .m0sC0v1um added to them, and this allows you to identify which ransomware you’re dealing with and which files have been affected. The malicious actors behind this ransomware are the only ones who have a decryptor necessary to recover your files. However, they will not just give it to you and instead demand almost $9,000 for it. At the moment, only users who have backups can recover files for free.

 

 

Moscovium ransomware appends the extension .m0sC0v1um to files it encrypts. As an example, a file named 1.txt will be renamed to 1.txt.m0sC0v1um once encrypted. This extension is added to all targeted files, including photos, videos, documents, images, etc. Files with this extension cannot be opened unless they are first decrypted using a specific decryptor tool, which is exclusively in the possession of the cybercriminals operating this malware.

Once all targeted files have been encrypted and the process is complete, the ransomware will create a !!!_DECRYPT_INSTRUCTIONS_!!!.txt ransom note. The information in the note is minimal, simply stating that a payment of 0.1 BTC (approximately $8,700 at the time of writing) must be sent to the provided wallet address.

If you do not have a backup, paying the ransom might seem like a good option. However, it should be mentioned that paying does not ensure you will receive a decryptor. Dealing with cybercriminals means that there is little motivation for them to assist victims, even those who comply with their demands. Many victims have paid ransoms in the past only to receive nothing in return. Additionally, by paying the ransom, you may inadvertently be enabling more criminal activities in the future.

The _readme.txt ransom note dropped by Moscovium ransomware:

== YOUR FILES ARE ENCRYPTED ==
Send 0.1 BTC to: bc1qxy2kgdygjrsqtzq2n0yrf249ndw0w2u5gq4p4g
Email proof to: m0sc0v1um@tutanota.com
== DO NOT ATTEMPT DECRYPTION YOURSELF ==

If you have a backup, you can begin file recovery as soon as you remove Moscovium ransomware from your system. It’s strongly recommended to use an anti-malware program for this, as ransomware is a complex infection that requires a professional program to get rid of. Additionally, be cautious not to connect to your backup while the ransomware is still on your computer, as this could result in the backed-up files becoming encrypted too, leading to permanent loss.

If you don’t have a backup and choose not to pay the ransom, your best course of action is to save the encrypted files and wait for a free decryption tool to be made available. If such a tool is released, it will be available for download on NoMoreRansom.

How is ransomware distributed?

Malware is distributed through several methods, and infections often stem from users’ unsafe browsing habits and risky online behaviors. By developing better habits and familiarizing yourself with the common ways malware is distributed, you can greatly decrease the chances of encountering malware in the future.

One major way malware spreads is through email attachments. If your email address has been exposed in a data breach or a leak, you’re likely to receive malicious emails once in a while. These emails are often disguised as parcel delivery notifications or order confirmations, with malicious files attached to them. Such emails often claim that the attachments are important documents that need to be reviewed as soon as possible. This puts pressure on users to open them. Fortunately for users, many malicious emails are quite generic and not difficult to identify as malicious. Look out for signs like grammar and spelling mistakes, which you’re unlikely to see in legitimate emails, especially in automatic ones.

Another thing to take note of is how the sender addresses you. If it’s a service provider who should know your name but uses terms like “User”, “Member”, or “Customer”, it may be spam or a malicious email. Using generic words to address users is very common in malicious emails because malware campaigns target many users with the same email.

Some malware email campaigns are more sophisticated and harder to identify. If you receive an unsolicited email with an attachment, be sure to scan it using an anti-virus program or a service like VirusTotal before you open it to ensure it’s not something malicious.

Another common method for malware distribution is torrents. Many torrent sites are poorly moderated, allowing malicious actors to upload infected files easily. This is especially true for torrents for entertainment content such as movies, TV shows, or video games. If you choose to download pirated material, remember that it’s not only content theft but also dangerous for your computer and data.

Remove Moscovium ransomware

It’s strongly recommended you use an anti-malware program to remove Moscovium ransomware from your device. Attempting to remove it manually may lead to further damage to your computer. After successfully removing the ransomware, you can reconnect to your backup securely.