Stop/djvu

STOP/DJVU is a ransomware family, detected by ESET as Win32/Filecoder.STOP, that has been repeatedly associated with infections stemming from untrusted software sources. The provided content states it heavily targeted students and individual consumers/small businesses, with frequent infections reported after victims downloaded pirated or cracked software, including commercial VST plugins, from sources such as search results, YouTube links, torrents, Telegram channels, Discord servers, and other piracy-related distribution points. The malware is described as a recurring ransomware family and may be marketed as ransomware-as-a-service. Ransom notes reportedly demanded roughly US$1,000 to US$1,200 in cryptocurrency, often offering a 50% discount if payment was made within 24 to 72 hours. Chainalysis data in the content lists Stop/djvu among ransomware strains active in 2023, with an average payment of US$619 and a median payment of US$563, consistent with lower-value attacks against smaller victims. The content also notes that cracked or leaked Stop/DJVU-related tooling/builders were advertised on the Russian-language cybercrime forum RAMP, including a January 2024 mention of a cracked builder targeting individual consumers and small businesses. A related threat, Zorab ransomware, is described as masquerading as a STOP Djvu decryptor and re-encrypting files with a .ZRB extension, underscoring that fake decryptor tools have been used in the STOP/DJVU ecosystem.