Buy Me a Coffee

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Ransom Notes: CLEARWATER_README.txt

Your files have been encrypted by CLEARWATER Ransomware. Unluck :(
Do not attempt decryption or recovery without proper instructions or your data will be lost.
To contact us, write to this TOR address:
http://b6rgpykvtyqah4q5tii25ouevr5g3u2s7pqc24jdlyhrfms3itljtkqd.onion/index.html?chat=[snip]

And remember, nothing personal, exclusively business!
Have a nice day, jolly Christmas and Happy New Year! :)
Indicators of Compromise
Type IOC
onion url http://b6rgpykvtyqah4q5tii25ouevr5g3u2s7pqc24jdlyhrfms3itljtkqd.onion/index.html?chat=[snip]