Beware: DJVU Ransomware's New 'Xaro' Variant Masquerades as Cracked Software
A new variant of the DJVU ransomware, named Xaro, is being distributed disguised as cracked software. This variant appends the .xaro extension to affected files and demands a ransom for decryption. Xaro is delivered as a payload of SmokeLoader and is propagated through an archive file from a dubious source posing as a legitimate freeware site. The attack chain involves the deployment of additional malware, including information stealers like RedLine Stealer and Vidar. Xaro encrypts files, drops a ransom note, and demands a payment of $980 for the private key and decryptor tool. The use of cracked software and freeware from untrusted sources increases the risk of such attacks.