Ransomnix ransomware variant encrypts websites

This report analyzes a newer variant of the Ransomnix ransomware targeting websites, detailing the ransom note (“JIGSAW RANSOMNIX 2018”), payment escalation logic implemented in JavaScript (starting at 0.2 BTC and increasing by 0.1 BTC daily from a 6 Apr 2018 timestamp), and key indicators including BTC wallet 1VirusnmipsYSA5jMv8NKstL8FkVjNB9o, email [email protected], and the .Crypt extension; it also notes evidence of payments and provides guidance for recovery (restore from backups, patch systems, change passwords) and prevention.