A new ransomware strain called PXJ ransomware (also known as XVFXGW ransomware) was first discovered in late February 2020.[1] Half of the known samples were uploaded from Korea, and it uses a Korean website for a C2, showing predominantly Asian targeting.
Details
The earliest PXJ ransomware sample is from 24 February 2020. It received its name for the .pxj extension that it adds to the files it encrypts. Its alternative name, XVFXGW, refers to the strings in two contact emails (xvfxgw3929@pr
