OREANDA-NEWS. The international company Group-IB which specializes in suppression and investigation of cybercrimes with use of high technologies, reports about attack of the Troldesh virus extortioner to the Russian firms. Swindlers distribute letters allegedly from mailboxes of large aviation carriers, automobile dealers and media.

Troldesh also known under the names Shade, XTBL, Trojan.Encoder.858, Da Vinci, No_more_ransome is virus which ciphers files on the infected device of the user and demands repayment to restore access to information. Its control center is posted online by Tor and constantly moves that complicates its blockage, increasing infection probability.

For the first time Troldesh has come into the view of experts of Group-IB in 2015. In March the 2019th virus in large quantities was dispatched on behalf of the famous retailers, the financial and construction organizations. Users have received the infected letters which senders appeared Auchan, "Magnet", Slavneft and PIK Group.