---
title: "Extortion Ploys Return With Jigsaw Ransomware Download | Phish Protection"
description: "Extortion Ploys Return With Jigsaw Ransomware Download: Learn more about the latest Jigsaw ransomware scam and how to protect yourself. Ransomware is one of."
image: "https://phishprotection.com/images/og-default.png"
canonical: "https://phishprotection.com/extortion-ploys-return-jigsaw-ransomware-download/"
---

#  Extortion Ploys Return With Jigsaw Ransomware Download 

## Extortion Ploys Return With Jigsaw Ransomware Download

### Learn more about the latest Jigsaw ransomware scam and how to protect yourself.

[Free Trial ](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection)

```
	###### [PHISHING PREVENTION](/content/phishing-prevention/)
```

### [WHAT IS PHISHING?](/resources/what-is-phishing/)

### [PROTECTION FROM PHISHING](/)

![As Seen On Phishprotection6](https://media.mailhop.org/phishprotection/images/2020/02/as-seen-on-phishprotection6.png) ![Jigsaw Ransomware Protection](https://media.mailhop.org/phishprotection/images/2021/02/jigsaw-ransomware-protection.jpg) 

_Ransomware is one of the methods used by hackers and adversaries to threaten people to pay money or lose files stored in their systems_. They use AES, an asymmetric encryption algorithm to encrypt the data and demand a ransom. This [ransomware](https://hackernoon.com/cryptography-malware-ransomware-36a8ae9eb0b9)\-type malware gets distributed through

- Fake software updates
- Malicious e-mail attachments
- Peer to peer (P2P) networks (for example, Torrent)
- Trojans

_The latest in the series of ransomware scams to hit thousands of systems across the world_ is the [jigsaw ransomware](/resources/ransomware-example/) download scam.

### How Jigsaw Scam Works?

_The Jigsaw scam came into the spotlight in 2016_. Named after the iconic character appearing in the ransom note, it installs ransomware into the user’s computer and takes control of the data stored in the system.

_It not only encrypts the victim’s files but also deletes them if they fail to pay the ransom_. It **deletes files every 60 minutes** when the program restarts. Cofense researchers analyzed the ransomware from a phishing jigsaw e-mail.

Unsuspecting users receive an e-mail stating that their account is compromised. The e-mail further adds as a proof the statement of their bank accounts. The link leads the users to a webpage hosting that appears to be PDF bank statement but is an MSI file.

Jigsaw victims, without giving any second thought download the attachments, _not realizing that they are unknowingly installing the ransomware into their system_.

![Jigsaw Ransomware Ploy](https://media.mailhop.org/phishprotection/images/2021/02/jigsaw-ransomware-ploy.png) 

### The Ransom Note Of Jigsaw Ransomware Scam

The latest **jigsaw ransomware** comes with live chat support and also uses the famous puppet image from the Hollywood movie “Saw”. Once the hackers install the ransomware files drpbx.exe and firefox.exe into the system, a ransom note appears on the victim’s screen. _It starts a countdown timer which threatens victims to pay the ransom or risk losing files incrementally every 1 hour_. It also contains instructions about how files are encrypted and how to retrieve them, etc. And _in case the victim decides to restart the system, the ransomware **deletes 1000 files** as a punishment_.

_Users who decide to pay the ransom need to purchase bitcoins for a specified amount and transfer the coins to an address provided by the hackers_. The [payment demanded](https://www.trendmicro.com/vinfo/pl/security/news/cybercrime-and-digital-threats/new-jigsaw-ransomware-variant-demands-5000-in-bitcoins) ranges from $20 to $200\. Once the victims move the amount, they will gain access to a **private key to decrypt** all files that were encrypted by cybercriminals.

### Received A Jigsaw E-mail? Follow These Steps To Protect Your System

To **remove jigsaw ransomware** from your system, please follow the [steps outlined](https://www.pcrisk.com/removal-guides/9942-fun-ransomware) below:

- _The first step in removing the ransomware is to reboot the system in **safe mode**_.
- The manual process of removing the jigsaw ransomware can be a bit tedious, but not impossible. But if you want to avoid these hassles, _you can download various Jigsaw Ransomware Removal Tools like “SpyHunter”_.
- _Open your Windows Hosts file and remove all the IPs added by the ransomware_. Open the Run window and then, paste the following code to open the host file “notepad %windir%/system32/Drivers/etc/hosts”.
- Next, open the system configuration window by typing MSConfig in the Run window and click enter. Click on the “Startup” tab. Now, uncheck every entry marked as “UnKnown” in the manufacturer’s column.
- Similarly, open the task manager and for unsuspicious processes, right-click on the process and click Open File Location to go to the parent folder and delete it._Remember to take caution, as the last thing you want is deleting the system files_. Use Google to look for the processes added by Jigsaw ransomware or **check the forums** to see what other jigsaw victims have posted.
- _Next step is to clean the registry_. Open the Registry Editor and start a search for the entries named with “Jigsaw”. Delete those entries. Remember to be careful, or you may end up deleting critical system information
- In the search window, type %Temp% and delete everything in that folder.
![Jigsaw Ransomware Protection](https://media.mailhop.org/phishprotection/images/2020/09/Jigsaw-ransomware-protection.png) 

### How To Decrypt Files Encrypted By Jigsaw Actors?

_Once your files get encrypted by Jigsaw ransomware, there is no need to panic_. There are various Jigsaw Removal and [Decryption tools](https://www.bleepingcomputer.com/news/security/jigsaw-ransomware-decrypted-will-delete-your-files-until-you-pay-the-ransom/) available online. Let’s see how to decrypt your files infected with Jigsaw.

- Before decrypting the files, _it is crucial to ensure the ransomware gets removed from the system_. Download “**Malware Removal Tool**” and scan the system thoroughly, eliminating all dangerous malware and ransomware.
- Next, download any Jigsaw Decrypter tool from the internet and open the tool.
- Choose the directory and click “Decrypt Files” to decrypt all the files encrypted by Jigsaw.
- _Remember that this process might take a lot of time_, depending on the number of files, size, etc. It is better to run this process during the night when it is not in use.

### How To Prevent Jigsaw Ransomware Download?

Let’s look at some tips to keep you protected from jigsaw actors:

- The principal weapon used by these hackers is to instill fear in the minds of the users about losing their valuable data. But, _if they back up their data regularly and have a full back-up readily available_, they don’t need to worry about any ransom demands or complying with them.
- _Next thing to remember is to stay alert when opening e-mails_. Users must be vigilant before clicking URLs on e-mails as it could be a **phishing e-mail**. _Always hover over the URL to ensure it takes to original place as intended_, or it is a fake URL. Also, check the “from” address and see if it is genuine.
- Make sure to keep the anti-virus and anti-malware systems updated all the time.
- _Adjust the browser and privacy settings for added protection_.
- It is prudent to abstain from opening e-mails from unknown senders.

### Conclusion

_Jigsaw is a ransomware scam which infiltrates systems, encrypts files, and then makes ransom demands_. There is a probability of jigsaw victims paying the ransom, and their data not being decrypted. Hence, users must desist from contacting the hackers or paying the ransom. It will only provide a gush of fresh air to their malicious intentions. The key to tackling such ploys is staying alert and sensible to phishing e-mails and use [ransomware protection](/products/malware-and-ransomware-protection/). For preventing data loss, it is essential to take r**egular back-ups** and check the genuineness of URLs and attachments before clicking them. _It is also vital to have the latest anti-malware and anti-virus software installed on the system_.

### Enterprise-class email protection without the enterprise price

For flexible per-user pricing, PhishProtection’s integrated email security solution protects your employees from business email compromise (BEC) and many other email threats. 24×7\. On any device. With features you’d expect in more expensive solutions:

**All Plans Come With**

- Stops business email compromise (BEC)
- Stops brand forgery emails
- Stop threatening emails before they reach the inbox
- Continuous link checking
- Real-time website scanning
- Real time alerts to users and administrators
- Protection with settings you control
- Protection against zero day vulnerabilities
- Complete situational awareness from web-based console
![Trusted By Phishprotection3](https://media.mailhop.org/phishprotection/images/2020/02/trusted-by-phishprotection3.png) 

### Join 7500+ Organizations that use Phish Protection

[ 60-Day Free Trial ](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection)

Phish Protection works with System Administrators, IT Professionals and IT Executives in thousands of companies worldwide. Sign up and protect your organization from phishing attacks in less than 5 minutes

![Sys Admin1](https://media.mailhop.org/phishprotection/images/2020/03/sys-admin1.jpg) ![Itprofessional1 E1585030432965](https://media.mailhop.org/phishprotection/images/2020/03/itprofessional1-e1585030432965.jpg) ![Directorofit1](https://media.mailhop.org/phishprotection/images/2020/03/directorofit1.jpg) 

## Protect your inbox from phishing attacks

Start your 60-day free trial - no credit card required.

[Start Free Trial](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection)

```json
{"@context":"https://schema.org","@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"21","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/phish-protection/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"Phish Protection","url":"https://phishprotection.com","description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
{"@context":"https://schema.org","@type":"Article","headline":"Extortion Ploys Return With Jigsaw Ransomware Download","description":"Extortion Ploys Return With Jigsaw Ransomware Download: Learn more about the latest Jigsaw ransomware scam and how to protect yourself. Ransomware is one of.","url":"https://phishprotection.com/extortion-ploys-return-jigsaw-ransomware-download/","dateModified":"2021-02-24T08:56:43.000Z","author":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection"},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/images/phishprotection-logo.png"},"description":"Enterprise-grade email security that protects businesses from phishing, ransomware, and email fraud with real-time threat detection and multi-layered protection.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://phishprotection.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897912","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Ransomware Protection","Business Email Compromise","Time of Click Protection","Advanced Threat Defense","Email Fraud Prevention","Phishing Awareness Training","Office 365 Email Security"]},"image":"https://media.mailhop.org/phishprotection/images/og-default.png"}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://phishprotection.com/"},{"@type":"ListItem","position":2,"name":"Extortion Ploys Return Jigsaw Ransomware Download","item":"https://phishprotection.com/extortion-ploys-return-jigsaw-ransomware-download/"}]}
```