Procedure examples

RansomHub has placed a ransom note on comrpomised systems to warn victims and provide directions for how to retrieve data.

ShrinkLocker renames disk labels on victim hosts to the threat actor's email address to enable the victim to contact the threat actor for ransom negotiation.

SameCoin can alter the victim’s background to display an image showing the name of Hamas’s military wing.

After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".

BlackCat can change the desktop wallpaper on compromised hosts.

Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.

ROADSWEEP has dropped ransom notes in targeted folders prior to encrypting the files.

Meteor can change both the desktop wallpaper and the lock screen image to a custom image.

Qilin can set the wallpaper on compromised hosts to display a ransom message in each encrypted folder.

INC Ransomware has the ability to change the background wallpaper image to display the ransom note.

Remcos has the ability to modify the desktop wallpaper.