Security Experts:

Connect with us

Hi, what are you looking for?



Users Warned of New Aerst, ScareCrow, and Vohuk Ransomware Families

Fortinet’s security researchers have shared information on three new ransomware families named Aerst, ScareCrow, and Vohuk.

Fortinet’s security researchers have shared information on three new ransomware families named Aerst, ScareCrow, and Vohuk.

Targeting Windows computers, these are typical ransomware families that encrypt victim files and demand a ransom payment in exchange for a decryption key. This new ransomware has been used in an increasing number of attacks.

Aerst was seen appending to encrypted files the ‘.aerst’ extension and displaying a popup window containing the attacker’s email address, instead of dropping a typical ransom note.

The popup window contains a field where the victim can enter a purchase key required to restore the encrypted data. Aerst deletes Volume Shadow copies to prevent file recovery.

Vohuk does drop a ransom note – readme.txt – asking the victim to contact the attackers via email. Seemingly under continuous development, the malware assigns a unique ID to each victim.

This ransomware family appends the ‘.vohuk’ extension to the encrypted files, replaces file icons with a red lock icon, and changes the desktop wallpaper with its own.

“The ransomware leaves a distinctive mutex, ‘GlobalVohukMutex’, which prevents different instances of Vohuk ransomware from running on the same system,” Fortinet explains.

The malware has been mainly targeting users in Germany and India.

ScareCrow’s ransom note, named ‘readme.txt’, instructs victims to contact the attacker using one of three Telegram channels. The threat appears to be the most widespread, with files submitted from the United States, Germany, India, Italy, the Philippines, and Russia.

Fortinet has identified some similarities between ScareCrow and Conti, such as the use of the CHACHA algorithm for encryption, and the use of the WMI command-line utility to delete Volume Shadow copies, which suggest that ScareCrow’s developers might have used Conti source code leaked earlier this year.

The ransomware’s developer has encrypted each command string in the malware, including DLL names, API names, and even command strings, with a different decryption routine. ScareCrow appends the ‘.crow’ extension to the encrypted files.

Related: Healthcare Organizations Warned of Royal Ransomware Attacks

Related: New Zealand Government Hit by Ransomware Attack on IT Provider

Related: Hive Ransomware Gang Hits 1,300 Businesses, Makes $100 Million

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


US government reminds the public that a reward of up to $10 million is offered for information on cybercriminals, including members of the Hive...


The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.