This rather odd ransomware deletes your data just a few bytes at a time

Security attack
(Image credit: Shutterstock / ozrimoz)

A new data-wiping malware has been detected, infecting more and more endpoints with each passing day - but what's most curious is that it poses as ransomware

The malware is called Azov Ransomware, and when run on a victim's device, it overwrites file data with junk, rendering the files useless. The overwrites are cyclical - the malware would overwrite 666 bytes of data, then leave the next 666 intact, then repeat the process. 

Even though there is no way to retrieve the corrupt files, there is no decryption key or ransom demands, the malware still comes with a ransom note, which says that victims should reach out to security researchers and journalists for help. 

Execution trigger

Another curious thing about Azov Ransomware is that it comes with a trigger, having it sit idly on the endpoint until October 27, 10:14:30 AM UTC, after which all hell breaks loose.

When this date comes, the victim doesn’t necessarily need to run the exact executable - running pretty much any program will do. That’s because the wiper will infect all other 64-bit executables on the devices whose file path does not hold these strings:

:\Windows
\ProgramData\
\cache2\entries
\Low\Content.IE5\
\User Data\Default\Cache\
Documents and Settings
\All Users,

In other words, running a seemingly benign program would crash the computer and ruin all of the data on it. 

Azov Ransomware is being distributed through the Smokeloader botnet, which is commonly found in fake pirated software and crack sites. 

Whoever is behind this wiper, their motives remain unclear. While some researchers think the wiper is used as a cover-up for other malicious behavior, others think the motive is nothing more than to troll the cybersecurity community. 

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Hands typing on a keyboard surrounded by security icons
35 years on: The history and evolution of ransomware
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
AWS S3 feature abused by ransomware hackers to encrypt storage buckets
A group of 7 hackers, 6 slightly blurred in the background and one in the foreground, all wearing black with hoods pulled up over their heads. You cannot see their faces. The hacker in the foreground sits with an open laptop in front of them. The background, behind the hackers, is a Chinese flag
China government-linked hackers caught running a seriously dangerous ransomware scam
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
More reports claim 2024 was the worst year for ransomware attacks yet
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
Sam Altman and OpenAI
OpenAI is upping its bug bounty rewards as security worries rise
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Latest in News
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
iPhone 13 mini
The iPhone mini won't be returning, according to rumors – and you think that's a mistake