Ordinypt

Last reviewed:

Ordinypt is a type of malware that masquerades as ransomware but primarily functions as a data wiper. It targets German-speaking users and is known for its destructive capabilities rather than financial gain. Ordinypt encrypts files and demands a ransom for decryption, but the malware irreversibly destroys the data, making recovery impossible even if the ransom is paid. As of October 2023, Ordinypt continues to pose a threat due to its deceptive nature and the irreversible damage it causes to infected systems.

Overview

Ordinypt, also known as HSDFSDCrypt, is a malware strain that disguises itself as ransomware. It targets users primarily in German-speaking regions. Unlike typical ransomware, which encrypts files and offers decryption upon payment, Ordinypt's primary function is to destroy data. The malware encrypts files and demands a ransom, but it does not provide a means to recover the data, even if the ransom is paid. This characteristic classifies Ordinypt as a wiper, a type of malware designed to delete or corrupt data.

History

Ordinypt first appeared in 2017, targeting businesses in Germany. The initial campaigns involved emails with malicious attachments, purporting to be job applications. These emails contained a ZIP file with an executable disguised as a PDF document. Upon execution, the malware encrypted the victim's files and displayed a ransom note in German. Despite the ransom demand, victims found their data irretrievably lost, as the malware did not store encryption keys necessary for decryption.

Technical characteristics

Ordinypt is written in Delphi, a programming language often used for developing Windows applications. The malware encrypts files with a random key and overwrites the original content, rendering the data unrecoverable. It targets a wide range of file types, including documents, images, and databases. The ransom note, written in German, instructs victims to contact the attackers via email to negotiate the ransom payment. However, due to the lack of decryption capability, paying the ransom does not lead to data recovery.

Infection vector

Ordinypt primarily spreads through phishing emails. These emails are crafted to appear as legitimate job applications, targeting human resources departments within organizations. The email contains a ZIP file attachment, which includes an executable file disguised as a PDF document. When the recipient opens the file, the malware executes and begins encrypting files on the system. This method relies on social engineering tactics to trick users into executing the malicious file.

Notable campaigns

The initial campaign in 2017 targeted businesses in Germany, using emails that appeared to be job applications. The campaign was notable for its focus on German-speaking users and its use of social engineering techniques. Subsequent campaigns have continued to target German-speaking regions, with similar tactics and objectives. The malware's destructive nature has led to significant data loss for affected organizations, highlighting the importance of awareness and education in preventing such attacks.

Detection and mitigation

Detecting Ordinypt involves monitoring for suspicious email attachments and unusual file encryption activity. Security software can help identify and block the malware before it executes. Organizations should implement email filtering solutions to block malicious attachments and train employees to recognize phishing attempts. Regular data backups are crucial, as they provide a means to restore data in the event of an infection. Since Ordinypt irreversibly destroys data, prevention and backup strategies are essential for mitigating its impact.

See also

Sources

Categories: Malware
Last updated: October 27, 2026