{"id":7350,"date":"2017-01-06T10:46:35","date_gmt":"2017-01-05T23:46:35","guid":{"rendered":"https:\/\/www.backupassist.com\/blog\/?p=7350"},"modified":"2025-07-28T05:42:45","modified_gmt":"2025-07-28T05:42:45","slug":"koolova-the-worlds-first-nice-ransomware","status":"publish","type":"post","link":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware","title":{"rendered":"Koolova: The World’s First ‘Nice’ Ransomware?"},"content":{"rendered":"

Every time I write an article on a new form of ransomware<\/a>, I’m always surprised. <\/strong>And Koolova, the latest ransomware to hit the scene, does not disappoint.<\/p>\n

Last year saw a host of bizarre ransomware variants. There was Popcorn Time<\/a>, which let you infect two users to get a free decryption key. Jigsaw<\/a>, which played out like having a Saw-movie<\/a> villain on your computer. And the Cerber ransomware<\/a>, which hijacked people’s speakers to talk to them directly.<\/p>\n

So you’d think the ransomware makers had run out of tricks. But they forgot to mention something.<\/p>\n

Apparently, Jigsaw has a brother<\/em>. His name is Koolova, and he’s concerned that you might fall under his brother’s influence.<\/p>\n

<\/p>\n

Ransomware Families: Quite Literally a Thing<\/h2>\n

Crypto-ransomware\u00a0is usually classified as part of a ‘family’, and brotherly bonds are not unheard of. Just this year,\u00a0we wrote about the terrible twins\u00a0‘Petya<\/a>‘ and ‘Mischa<\/a>‘ \u2014 two more rule-breakers who sparked a trend of selling Ransomware-as-a-Service (RaaS). And even ruder, they didn’t even properly give you back your data once you paid them.<\/p>\n

Koolova, however, is nothing like his brother Jigsaw. Where Jigsaw holds your files ransom and destroys your data bit by bit, like a deranged serial killer, Koolova holds your data hostage\u00a0to ‘help’ you.<\/p>\n

Koolova: “Hi, I’m Nice Jigsaw…”<\/h2>\n

The moment you are infected, Koolova gives you a friendly introduction in nonthreatening green text. It even drops some smiley faces in there to make you feel at ease. Like all ransomware, it tells you your personal files are encrypted, but it doesn’t ask for a ransom.<\/p>\n

Instead, Koolova asks you to read two documents on how to stay safe from ransomware.<\/p>\n

\"Koolova<\/a><\/p>\n

Yes, that’s right. Koolova doesn’t even direct you to malicious websites. Instead, they’re highly legitimate articles: one is from the Google Security Blog called ‘Stay safe while browsing<\/a>‘, and the other is BleepingComputer’s ‘Jigsaw Ransomware Decrypted: Will delete your files until you pay the Ransom<\/a>‘ article.<\/p>\n

The second you read both articles, the Decrypt My Files button becomes available. When you click on it, it connects to the Command and Control Server to retrieve your decryption key. And then it gives you a funny little popup called ‘Nice Jigsaw’ with the decryption key, which is… well… read it for yourself.<\/p>\n

\"Koolova<\/a><\/p>\n

I’m not usually one to resort to memes, but after reading this? I can’t even<\/a>.<\/p>\n

… But Koolova gets Mean if You Don’t Read the Articles<\/h2>\n

Koolova doesn’t give you long at all to read the articles. And if you don’t read them, it goes ahead and deletes the files. Don’t let the nice guy act fool you into thinking it doesn’t follow through.<\/p>\n

So functionally, Koolova is exactly the same as regular ransomware, except the payment method is just different.<\/p>\n

So is Koolova a Villain or a Dark Hero?<\/h2>\n

Opinions are already divided on whether or not Koolova is a good or a bad thing. Some frustrated SysAdmins\u00a0who are sick of running counter-phishing training<\/a> for their users are lauding Koolova’s arrival, whereas other professionals such as BleepingComputer’s creator and owner, Lawerence Abrams, are calling it “creepy” and “strange”<\/a>.<\/p>\n

As usual, the best countermeasure for ANY ransomware\u2014’good’ or bad\u2014is to backup your data! Make sure you’ve stored it securely using a 3-2-1 backup method<\/a> and with a trusty backup software such as BackupAssist<\/a>. It’s the only sure way to be untouchable by crypto-ransomware. There’s a free trial<\/a> of BackupAssist you can download, and if you’re unprotected, I’d recommend it ASAP.<\/p>\n

So is Koolova a villain or a dark hero? Black hat or white hat? Tell us what you think!<\/em><\/p>\n

Share your opinion\u00a0here in the\u00a0comments section, tweet @BackupAssist<\/a> or post to facebook<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Every time I write an article on a new form of ransomware, I’m always surprised. And Koolova, the latest ransomware to hit the scene, does not disappoint. Last year saw a host of bizarre ransomware variants. There was Popcorn Time, which let you infect two users to get a free decryption key. Jigsaw, which played … Read more Koolova: The World’s First ‘Nice’ Ransomware?<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":19723,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,23],"tags":[527,311],"class_list":["post-7350","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-interest","category-news","tag-koolova","tag-ransomware"],"yoast_head":"\nKoolova: The World's First 'Nice' Ransomware?<\/title>\n<meta name=\"description\" content=\"Koolova is the brother to the infamous Jigsaw ransomware, but with a strange twist. It decrypts your data for free if you read two articles on ransomware.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Koolova: The World's First 'Nice' Ransomware?\" \/>\n<meta property=\"og:description\" content=\"Koolova is the brother to the infamous Jigsaw ransomware, but with a strange twist. It decrypts your data for free if you read two articles on ransomware.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Resilience Blog\" \/>\n<meta property=\"article:published_time\" content=\"2017-01-05T23:46:35+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-28T05:42:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1366\" \/>\n\t<meta property=\"og:image:height\" content=\"486\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Adam Ipsen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Adam Ipsen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\"},\"author\":{\"name\":\"Adam Ipsen\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/7a3a759eceffd2e597d435c34ed3519d\"},\"headline\":\"Koolova: The World’s First ‘Nice’ Ransomware?\",\"datePublished\":\"2017-01-05T23:46:35+00:00\",\"dateModified\":\"2025-07-28T05:42:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\"},\"wordCount\":618,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg\",\"keywords\":[\"Koolova\",\"ransomware\"],\"articleSection\":[\"Interest\",\"News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\",\"url\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\",\"name\":\"Koolova: The World's First 'Nice' Ransomware?\",\"isPartOf\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg\",\"datePublished\":\"2017-01-05T23:46:35+00:00\",\"dateModified\":\"2025-07-28T05:42:45+00:00\",\"description\":\"Koolova is the brother to the infamous Jigsaw ransomware, but with a strange twist. It decrypts your data for free if you read two articles on ransomware.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage\",\"url\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg\",\"contentUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg\",\"width\":1366,\"height\":486},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.backupassist.com\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Koolova: The World’s First ‘Nice’ Ransomware?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#website\",\"url\":\"https:\/\/www.backupassist.com\/blog\/\",\"name\":\"Cyber Resilience Blog\",\"description\":\"Protect Your Cloud Data with BackupAssist\",\"publisher\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.backupassist.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#organization\",\"name\":\"Cyber Resilience Blog\",\"url\":\"https:\/\/www.backupassist.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg\",\"contentUrl\":\"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg\",\"caption\":\"Cyber Resilience Blog\"},\"image\":{\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/7a3a759eceffd2e597d435c34ed3519d\",\"name\":\"Adam Ipsen\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d1cb7aaf3e3a12c73b037ce2cd62192517634d57a26edc34ff6b01f40fce1a50?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d1cb7aaf3e3a12c73b037ce2cd62192517634d57a26edc34ff6b01f40fce1a50?s=96&d=mm&r=g\",\"caption\":\"Adam Ipsen\"},\"url\":\"https:\/\/www.backupassist.com\/blog\/author\/adam-ipsen\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Koolova: The World's First 'Nice' Ransomware?","description":"Koolova is the brother to the infamous Jigsaw ransomware, but with a strange twist. It decrypts your data for free if you read two articles on ransomware.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware","og_locale":"en_US","og_type":"article","og_title":"Koolova: The World's First 'Nice' Ransomware?","og_description":"Koolova is the brother to the infamous Jigsaw ransomware, but with a strange twist. It decrypts your data for free if you read two articles on ransomware.","og_url":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware","og_site_name":"Cyber Resilience Blog","article_published_time":"2017-01-05T23:46:35+00:00","article_modified_time":"2025-07-28T05:42:45+00:00","og_image":[{"width":1366,"height":486,"url":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg","type":"image\/jpeg"}],"author":"Adam Ipsen","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Adam Ipsen","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#article","isPartOf":{"@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware"},"author":{"name":"Adam Ipsen","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/7a3a759eceffd2e597d435c34ed3519d"},"headline":"Koolova: The World’s First ‘Nice’ Ransomware?","datePublished":"2017-01-05T23:46:35+00:00","dateModified":"2025-07-28T05:42:45+00:00","mainEntityOfPage":{"@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware"},"wordCount":618,"commentCount":0,"publisher":{"@id":"https:\/\/www.backupassist.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage"},"thumbnailUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg","keywords":["Koolova","ransomware"],"articleSection":["Interest","News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware","url":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware","name":"Koolova: The World's First 'Nice' Ransomware?","isPartOf":{"@id":"https:\/\/www.backupassist.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage"},"image":{"@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage"},"thumbnailUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg","datePublished":"2017-01-05T23:46:35+00:00","dateModified":"2025-07-28T05:42:45+00:00","description":"Koolova is the brother to the infamous Jigsaw ransomware, but with a strange twist. It decrypts your data for free if you read two articles on ransomware.","breadcrumb":{"@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#primaryimage","url":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg","contentUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2016\/05\/Blog-Header-Image-Generic-2.jpg","width":1366,"height":486},{"@type":"BreadcrumbList","@id":"https:\/\/www.backupassist.com\/blog\/koolova-the-worlds-first-nice-ransomware#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.backupassist.com\/blog"},{"@type":"ListItem","position":2,"name":"Koolova: The World’s First ‘Nice’ Ransomware?"}]},{"@type":"WebSite","@id":"https:\/\/www.backupassist.com\/blog\/#website","url":"https:\/\/www.backupassist.com\/blog\/","name":"Cyber Resilience Blog","description":"Protect Your Cloud Data with BackupAssist","publisher":{"@id":"https:\/\/www.backupassist.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.backupassist.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.backupassist.com\/blog\/#organization","name":"Cyber Resilience Blog","url":"https:\/\/www.backupassist.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg","contentUrl":"https:\/\/www.backupassist.com\/app\/uploads\/sites\/3\/2019\/09\/BA-Logo-Full-Logo.svg","caption":"Cyber Resilience Blog"},"image":{"@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/7a3a759eceffd2e597d435c34ed3519d","name":"Adam Ipsen","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.backupassist.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d1cb7aaf3e3a12c73b037ce2cd62192517634d57a26edc34ff6b01f40fce1a50?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d1cb7aaf3e3a12c73b037ce2cd62192517634d57a26edc34ff6b01f40fce1a50?s=96&d=mm&r=g","caption":"Adam Ipsen"},"url":"https:\/\/www.backupassist.com\/blog\/author\/adam-ipsen"}]}},"_links":{"self":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts\/7350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/comments?post=7350"}],"version-history":[{"count":1,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts\/7350\/revisions"}],"predecessor-version":[{"id":19987,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/posts\/7350\/revisions\/19987"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/media\/19723"}],"wp:attachment":[{"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/media?parent=7350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/categories?post=7350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.backupassist.com\/blog\/wp-json\/wp\/v2\/tags?post=7350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}