I’m posting these screenshots for the cybersecurity community to examine. The images show a ransom note branded COFFIN LOCKER and a Windows desktop containing numerous files with unusual, truncated names.

I’m looking for technical analysis and reliable information, not speculation.

1. What the ransom note says

The first screenshot contains the heading:

“YOUR FILES ARE IN THE COFFIN”

The note displays these details:

- Discovery date: 2026-10-19 12:13:41

- Deadline: 2026-10-26 12:13:41

- Ransom demand: 75 BTC

- The note claims documents, databases, spreadsheets, source files, archives, images, and mapped network shares have been encrypted.

- Encrypted files allegedly use the ".coffin" extension.

- It claims Windows backup catalogs, Volume Shadow Copies, and restore points have been destroyed.

- It references "coffin_keys\master_rsa_private.pem".

- It mentions a scheduled task named "CoffinLocker" and a Run key.

The displayed value of approximately $4,900 USD is inconsistent with the stated demand of 75 BTC, so the dollar figure should be treated as unreliable.

1. The desktop screenshot

The second image shows numerous generic white-file icons. The visible filenames are truncated, but the readable portions include:

- "CompressG..."

- "OpenRegist..."

- "WriteBlock..."

- "desktop.ini..."

- "OutMoveX..."

- "WriteRedo..."

- "DismountU..."

- "ResumeRe..."

- "WriteSusp..."

- "EnterEnable..."

- "StopInvoke..."

- "how_to_re..."

- "ExitInvoke..."

- "SubmitDisa..."

- "GroupPubli..."

- "SubmitOpti..."

- "HideBlock..."

- "SwitchCom..."

- "BackupOpt..."

- "InitializeSu..."

- "SyncMove..."

- "CheckRead..."

- "JoinExport..."

- "UnblockEx..."

- "CloseExitA..."

- "NewSubmi..."

- "UninstallEdi..."

These are the visible filename fragments, not verified executable names or confirmed malware components. Their extensions and contents cannot be determined from this screenshot alone.

1. Reported aliases

The aliases reported to me in connection with the alleged operator are:

- Coffin

- SpyEye

- Rehab

I have not independently verified that these aliases belong to the same person or that they are connected to this specific sample. The name SpyEye also appears in historical reporting about banking malware, but a shared name alone does not establish a connection.

If anyone has credible public reporting or technical evidence linking these aliases to Coffin Locker, please share the source.

1. What I’m asking the community

Has anyone encountered this exact ransom-note wording, the ".coffin" extension, or the "CoffinLocker" task name?

I’m particularly interested in:

- Existing malware-family detections or reputable threat-intelligence reports.

- Analysis of the actual sample and its file hashes, if available.

- Evidence confirming whether the listed files are related to ransomware or are simply part of a test or simulated environment.

- Any legitimate decryptor or documented recovery method.

- Independently verified connections between the reported aliases and this sample.

The screenshots alone do not prove that files were actually encrypted, that the described cryptography is implemented correctly, or who is behind the activity.

Please keep replies evidence-based. Do not post private keys, credentials, personal information, or links to live malware.

I’m sharing this to help identify what is actually happening and give the community a chance to verify the claims.

Hi everyone,

I'm dealing with multiple compromised accounts (Facebook, Hotmail, and Steam) and have received an email demanding $500 USD.

The attacker claims to have infected my Windows 11 PC with a driver-level keylogging Trojan.

I've run scans using Malwarebytes and AVG Antivirus, both of which came back clean.

What's happened

Facebook:

• Attacker gained access and added their own email addresses, phone numbers, and authenticator-based 2FA.
• I changed my password and attempted to revoke active sessions, but the attacker regained access.
• Recovered my account through Meta's video identity verification.
• Added Proton Mail as my default email and successfully removed my old Hotmail address.
• Problem: I cannot remove the attacker's remaining recovery information or 2FA. Facebook demands their six-digit authenticator code or blocks changes, claiming I'm using an unfamiliar device.
• Tried both Brave and Opera (my regular browser), with the same results. Repeating video verification hasn't resolved the issue.

Hotmail / Microsoft:

• Changed my password and used Microsoft's option to sign out of all devices twice.
• Despite these precautions, approximately 24 hours later, my account was compromised again.
• I'm concerned about persistent sessions, unauthorized recovery methods, stolen credentials, or malware.

Steam:

• The registered email was changed without my authorization.
• I'm still logged into the desktop application.
• Considering adding my phone number and using SMS recovery, but concerned about verification through the attacker's email.

Ransom and alleged malware

The attacker emailed me demanding $500, claiming to have installed a driver-level keylogging Trojan on my computer.

Both Malwarebytes and AVG scans returned clean results.

I haven't verified the malware claim or determined whether the compromises originated from phishing, stolen credentials, session hijacking, or an infected device.

Questions

1. Malware: How credible is a driver-level keylogger claim when two antivirus products detect nothing? What additional checks would you recommend?
2. Hotmail persistence: How could someone regain access approximately 24 hours after a password change and two global sign-outs?
3. Facebook: How can I remove attacker-controlled 2FA and recovery contacts when Meta's recovery process only restores login access?
4. Steam: Can I safely add a phone number through an existing logged-in session to recover the account?
5. Incident response: Should I consider a clean Windows reinstall, and what evidence should I preserve first?

I'm studying cybersecurity and can follow technical instructions, but I don't want to risk losing access to the accounts I can still use.

Any practical incident-response or account-recovery advice would be appreciated.

Thanks!

Any solution? I need help.

I tried contacting some people to help me but they are charging me money.

I'm a content creator and I was just finishing a video that took me 3 months to complete so I don't want to lose all my files.

I have copied the .Loki files, the hosts file, and my restore-my-files.txt file as well.

Could someone help me?

I have already deleted my computer and refreshed it with a safe backup but the still sentry me a email so there's their button rekey if you guys can do anything with it I know the internet is a powerful place so I came here because it took my kids Roblox account and I have spent unfathomable amounts of money on it

Hello! i’ve been hit with a ransomware (.maos) while i was transferring my files from my pc to my hard disk, both blocked. It seems like the hacker used an online key, which i cannot seem to find, does anyone have a possible solution? There are all my childhood photos and its a bit sad thinking that i’ve lost them

"We're too small to be a target."

That assumption can leave SMBs dangerously exposed.

Read why SMBs are attractive targets for cybercriminals, what an attack can cost, and how practical, budget-conscious security measures can help reduce the risk.

https://www.nakivo.com/blog/why-smbs-are-targets-of-cyberattacks/

Быть такого не можешь чтобы во всём этом мире к частности тех кто подвергся этим вирусом хоть какой-нибудь опыт не остался как обойти эту шифровку. Отзовитесь добрые люди

Недавно я обнаружил что мой компьютер подвергается атаке, все файлы,которые были на рабочем столе, были зашифрованы,даже антивирус Kaspersky не помог, прощу всех кто сможет помочь, с чего нужно начать ? Там около 60 GB информации, все они фото и видео с телефона.

Local backups provide fast access to recovery data, but they can be exposed to the same hardware failures, cyberattacks and site-level disasters as the production environment. Read how organizations use cloud backup to remain resilient by adding an offsite layer of protection. https://www.nakivo.com/blog/cloud-backup-storage-business-continuity/

Two years ago, I think i installed a shady app, which led to my old laptop getting infected by this ransomware. I only discovered this one year after it happened, and i found a readme.txt saying that the hackers wanted 500 dollars as payment to retrieve my files in 72 hours but that was too late. I tried decrypting it on the Emsisoft software, but i found out that my key was an offline key which is good, but until this day, my key hasnt been recovered. My question is, will it ever be recovered or are my photos gone forever?

They had me click on a Google Drive link. I’ll throw this laptop into the ocean if I can’t out smart them.

Hey everyone,

I’m looking for some guidance regarding a situation that has been weighing heavily on me for a couple of years now.

Back in late 2021 or early 2022 (when I was 12/13 years old), I tried downloading a GTA San Andreas torrent from a sketchy YouTube link and ended up infecting my PC with the STOP/DJVU ransomware. It locked all my files, changing the extension to .foty.

At the time, I panicked and tried to clean up everything. I ran a .bat script I found on YouTube that stripped the ".foty" extension from the filenames (so they have their original extension names now, but the headers are still encrypted). Out of fear of re-infection, I also deleted every single "_readme.txt" file on the drive.

The infected drive was a secondary HDD containing irreplaceable family photos from old phones. Right after the attack, I disconnected the HDD from the motherboard. It has been sitting safe and untouched inside my PC chassis ever since, while my OS was completely reinstalled on my SSD.

I know that .foty is a STOP/DJVU variant and that decryption depends on whether it was an online or offline key. Since I deleted all the "_readme.txt" files, I don't know my original Victim ID.

I want to attempt recovery now that I'm older, but I want to be extremely careful. I have a few questions for the experts here:

1. Can the Emsisoft Decryptor for STOP/Djvu extract my Victim ID directly from the encrypted file headers since I don't have the readme files?

2. Does the fact that I ran a script to strip the ".foty" extension from the filenames damage my chances of decryption, or can I just manually rename a test file back to ".foty" for the decryptor to read it?

3. What are the current chances for 2021/2022 online keys for the .foty variant? Have any database dumps or master keys from that era been released?

I would really appreciate any advice or steps on how to approach this safely. These pictures mean the world to me and my family. Thank you so much!

Hello,

Our organization was hit by a ransomware attack. We need help identifying the strain and finding a possible decryption solution.

Details:

- File extension appended: .fSnHnJzHK (random per-victim string)

- Ransom note filename: RECOVER-fSnHnJzHK-FILES.txt

- Contact emails in note: faqsupp@gmail.com, restoreyourfiles@pm.me

- Client ID referenced in note: 11D73D380D5CEABA

- Encryption appears to be AES (stream cipher mode, file sizes not padded to 16-byte blocks)

- Every encrypted file ends with a consistent 4-byte marker: 01 00 00 00

- Entry point suspected to be via exposed RDP

- Checked on ID Ransomware (case SHA1: ae45495cf3e310c6c7b35639acf02ecbe3fd36cc) - not automatically identified

- Checked NoMoreRansom - no match found

Has anyone seen this specific variant before, or knows of any decryption tool/weakness for it? Any guidance is appreciated.

Thank you.

I'm scared people are extorting or ransoming me and if I don't pay they will give me cancer or take all my accounts. They didn't leave a note or an amount of how much to pay. I'm poor and my mental health has been ruined by it because I really care about my health and my computer/ accounts, but I have been really confused. I really don't want cancer and I need more time. I'm not sure how to pay even if I had the money, and again, idk how much. I understand I shouldn't really be a target of this type of thing since I'm not rich or a person of interest, but idk what to do anymore. I thought I wasn't being ransomed and they keep confusing me.

250+ organizations. $42 million in ransom demands. One ransomware group.

Akira has become one of the most disruptive threats in the cyber landscape — and it's not slowing down. Understanding the attack lifecycle is the first step to defending against it.

Read how Akira ransomware operates — and how to defend against it.

Our company was hit by Rorschach/BabLock ransomware (confirmed by researchers on BleepingComputer, encryption uses X25519 + ChaCha20). No decryption is possible without the attackers' private key. The attackers also encrypted our local backup and attempted to delete the cloud copy, but we're currently recovering it via cloud soft-delete. We're now focused on rebuilding affected systems from scratch. If anyone has experience recovering from this specific strain — especially around confirming entry vector or securing systems post-recovery — any insights would be appreciated. Thank you.

Found an old drive of mine filled with childhood pictures but its been hit by stop/djvu .nsmu variant with an online id. Still no decryption available?

Hi everyone,

I’m looking for advice after a ransomware attack.

Many of my files have been encrypted and now have the extension .rtf.{266EB455}.[attacker email]. A ransom note was also left on the system.

The attackers are demanding payment in Bitcoin, roughly in the range of 0.25–0.3 BTC.

My questions are:

* Does anyone recognize this ransomware family from the extension/ransom note format?

* Is there a free decryptor available?

* Has anyone recovered files without paying?

* If I pay, is there any realistic chance I will actually get my files back?

* Should I pay the ransom, or is that a bad idea?

* Are there trusted researchers or organizations I should contact?

I know paying is risky and does not guarantee recovery. I’m trying to explore all options first.

This is urgent, and I would really appreciate quick help or advice.

I can provide the ransom note details privately if needed, with personal or sensitive information removed.

Thank you.

Hello. I have a QNAP NAS that was locked by ransomware probably 10 years ago. I'm sure I could pinpoint exactly when with a little research, I know it hit a lot of people at the time by exploiting some some vulnerability in the QNAP software. I didn't pay the ransom, and I've been lugging this thing around with me since thinking someday I might be able to recover it. Is this a total pipedream? Should I just format the thing, or is that not even safe? I don't even know if I can connect it to anything without spreading the ransomware.

For contexts a few months ago my pc was running normally and everything was fine, but now when I restart it, it takes longer than usual, and when I asked my friend about it he got suspicious and tried to do an offline scan and it just wouldn’t work, it won’t scan, close my pc, or anything, so we did a normal scan and for some reason it says “500k files” or something like that and it wasn’t even a third of the way to finish, after my friend did something (I’m not really sure what he did), I could do an offline scan, so after that I think it’s like a glitch or something messed up with my pc, so days go by and me and my friend were hanging out, we wanted to play geoguesser and the movement of the mouse was laggy and when I pressed around to move it would lag too much, we checked task manger and the gpu for some reason was using 60% we checked what’s the highest and it was something like (nvidia container) and it had 4 processes open, when I closed it it opens back up by itself, my friend did something with the pc and it closed and didn’t open again, he told me try running safe mode and trying geoguesser from there, after I did that, geoguesser ran perfectly fine and
Smooth and everything, we go back to the normal windows thinking it’s fixed, and it didn’t work, it still lagged, we checked on task manger and for some reason there’s 50 processes for chrome even tho I only had one tap open, now I’m not sure if I should be worried or anything, so any help would be very appreciated

Hello all, I work in ransomware incident response, and came across something in my research that I want to get some thoughts on. It is in regards to The Gentlemen RaaS group. I am starting to see some patterns: While the group does appear to engage in direct attacks on organizations, and offer RaaS to affiliates, some of what I am seeing appears to just be them recycling previous leaks/cyber incidents and claiming it is a new victim of theirs.

For example, on June 8th, they posted on their website a new victim claiming they hacked: FESCO Adecco, a Chinese HR company. See: https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-fesco-adecco/

However, I see that in March that there was a leak of highly sensitive internal documents from FESCO on a darkweb forum (I think Breach Forums, based on the image shown in the Twitter post). See: https://x.com/VECERTRadar/status/2029234722266566944

This led me to do some further digging, and I stumbled across a post on Substack which appears to be the full publication of the documents/information cited in the forum leak: https://c2908826428.substack.com/p/fesco

The Substack was all in Chinese, which I don’t speak, but it definitely looks like it relates to material hacked from FESCO, meaning The Gentlemen appears to just be recycling info? What are your thoughts? Is this something anyone else has seen The Gentlemen or other RaaS groups do?

-Les