BlackHeart Ransomware

BlackHeart is a ransomware strain belonging to the MedusaLocker family. It encrypts files on infected systems and appends the .blackheart138 extension to each file. The ransomware then drops a ransom note named read_this_to_decrypt_files.html, instructing victims on how to contact the attackers and pay for decryption.

Overview of BlackHeart Ransomware

Feature	Details
Name	BlackHeart Ransomware
Threat Type	Ransomware, Crypto Virus, File Locker
Encrypted Files Extension	.blackheart138
Ransom Note Name	read_this_to_decrypt_files.html
Associated Email Addresses	support1@contonta.com, support2@cavopo.com
Detection Names	Avast (Win64:RansomX-gen [Ransom]), CTX (Exe.ransomware.medusalocker), ESET-NOD32 (A Variant Of Win64/Filecoder.MedusaLocker.A), Kaspersky (HEUR:Trojan-Ransom.Win32.Generic), Microsoft (Ransom:Win64/MedusaLocker)
Symptoms	Files are inaccessible and have a .blackheart138 extension, ransom note displayed, ransom demanded in cryptocurrency, warning against third-party recovery tools
Damage	Encrypts all personal and business files, steals sensitive data, threatens to leak stolen information, prevents system recovery
Distribution Methods	Phishing emails, infected attachments, torrent websites, malicious ads, fake software installers, outdated software vulnerabilities
Danger Level	Critical (Data loss, financial extortion, identity theft risks)

---

BlackHeart Ransom Note Overview

Contents of the ransom note (read_this_to_decrypt_files.html):

Your personal ID:
-
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)

ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.

DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.

No software available on internet can help you. We are the only ones able to
solve your problem.

We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..

We only seek money and our goal is not to damage your reputation or prevent
your business from running.

You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.

Contact us for price and get decryption software.
email:
support1@contonta.com
support2@cavopo.com

* To contact us, create a new free email account on the site: protonmail.com

IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
* Tor-chat to always be in touch:

---

How Did BlackHeart Infect Your Computer?

Cybercriminals use various tactics to spread ransomware, including:

• Phishing Emails: Malicious attachments or links trick users into executing the ransomware.
• Exploiting Software Vulnerabilities: Outdated operating systems or software can be targeted.
• Compromised Websites: Drive-by downloads install ransomware silently.
• Malicious Ads (Malvertising): Clicking infected ads can trigger automatic downloads.
• P2P Networks & Torrents: Downloading cracked software or keygens can introduce malware.
• USB Devices & External Drives: Infected removable storage can spread the ransomware.

---

How to Remove BlackHeart Ransomware (Step-by-Step Guide)

Step 1: Disconnect from the Internet

This prevents further data exfiltration or ransomware communication with its command-and-control servers.

Step 2: Boot into Safe Mode

1. Restart your computer and press F8 (or Shift + Restart on Windows 10/11).
2. Select Safe Mode with Networking.

Step 3: Use SpyHunter to Detect and Remove BlackHeart

1. Download SpyHunter Anti-Malware.
2. Install and launch the program.
3. Click Start Scan Now to detect ransomware.
4. Once detected, click Fix Threats to remove BlackHeart completely.

Step 4: Restore Your Files (If Backup Is Available)

• If you have cloud backups (Google Drive, OneDrive), restore files from there.
• If using offline backups, format the system and restore files afterward.
• Use Windows Previous Versions (Right-click > Properties > Restore Previous Version).

Step 5: Reinstall Windows (If Necessary)

If the system is severely compromised, a clean Windows reinstall may be required.

---

How to Prevent Future Ransomware Infections

Keep Your Software Updated

• Enable automatic updates for Windows and all installed programs.
• Update antivirus definitions regularly.

Backup Important Data Regularly

• Store backups on offline external drives or secure cloud storage.
• Never keep backups on the same device.

Avoid Suspicious Emails & Links

• Don’t open attachments from unknown senders.
• Avoid clicking on links in phishing emails.

Use a Reputable Anti-Malware Tool

• Install SpyHunter for real-time ransomware protection.
• Schedule regular system scans.

Enable Ransomware Protection in Windows

• Go to Windows Security > Virus & Threat Protection.
• Enable Controlled Folder Access.

---

Conclusion

BlackHeart ransomware is a dangerous malware that encrypts files and demands payment for decryption. Victims should never pay the ransom, as it does not guarantee file recovery. Instead, removing the ransomware with SpyHunter and restoring files from backups is the safest approach. To prevent future infections, adopt strong cybersecurity measures, avoid suspicious downloads, and use reliable anti-malware software.