Over the past few years, we’ve seen a growing wave of ransomware attacks targeting not just large enterprises, but small businesses as well. One of the most deceptive and financially damaging threats in this space is the Nigra Ransomware, a malware strain that has quietly wreaked havoc on organizations across Greece.
At Tictac Cyber Security, we’ve handled dozens of Nigra Ransomware incidents in the past three years across the country, helping businesses recover and proactively defend against future attacks.
What is Nigra Ransomware?
Nigra is a ransomware variant that encrypts files and appends the extension .nigra to them. It mainly targets small businesses with up to 30 employees, taking advantage of weak cybersecurity controls and exposed systems.
Although the ransom demands are relatively “modest”—typically between €1,000 and €10,000—our real-world cases show a far more dangerous pattern:
- Victims often report that even after paying, the attacker demands additional payments, sometimes up to three times the original ransom.
- Businesses are left trapped, with no guarantees of receiving a valid decryptor or recovering their data.
The Ransom Note – README_WARNING.txt
Upon infection, Nigra leaves behind a file named README_WARNING.txt, which includes a structured FAQ-style ransom demand:
::: Greetings :::
Little FAQ:
.1.
Q: Whats Happen?
): Your files have been encrypted for NIGRA. The file structure was not damaged, we did everything possible so that this could not happen.
.2.
Q: How to recover files?
): If you wish to decrypt your files you will need to pay us
you can send a three small files for testing,’excel ,word,txt,jpg’ something.
As a guarantee of our decryption ability.
.3.
Q: How to contact with you?
): You can write us to our 3 mailboxes: [stp9@startmail.com] [restaurera@rbox.co] [avq@inbox.eu]
If we do not reply within 24 hours, it means that the mailbox has been blocked, please contact our backup mailbox.
(please in subject line write your ID: XXXXXXXXXX)
:::WARNING STATEMENT:::
DON’T try to change encrypted files by yourself!
We have never posted any decrypted videos on youtube, any SNS, please don’t trust those crooks who post so-called decrypted videos
choose to trust them, unless you have a lot of money!
If you need decryption, please contact us via our email, we will only get in touch with you via email.
The private key for decryption only exists in our hands, and only we can help decrypt files in this world !
Who Does Nigra Target?
Unlike enterprise-level ransomware groups like Lockbit or Akira, Nigra focuses on small businesses that lack in-house IT or formal cybersecurity policies. The group typically targets:
- Law offices
- Accounting firms
- Clinics and retail stores
- Local service providers and small tech companies
Nigra does not rely on data leaks or double extortion, making it unique in its category—but no less dangerous.
How Nigra Gains Access – Attack Vectors
Based on dozens of cases managed by Tictac Cyber Security, Nigra gains access through some of the most overlooked and preventable weaknesses in small business infrastructure:
1. Exposed RDP (Remote Desktop Protocol) Ports
Attackers scan the internet (via tools like Shodan) to find open RDP ports (TCP 3389), then brute-force their way in using common or leaked credentials.
2. Poorly Secured Microsoft SQL Servers
Nigra actively targets exposed MSSQL servers, especially those using default or weak credentials (e.g., sa, admin). Once inside, attackers can upload tools, explore the environment, and prepare encryption.
3. Hidden or Abandoned Admin Accounts
Attackers either create new administrator accounts or use forgotten ones to maintain access.
4. Manual Execution
Many Nigra incidents are human-operated. Attackers navigate through the system manually and tailor their attack to each victim.
5. SQL Server Shutdown Requirement
The attacker insists that the SQL Server service be manually stopped before attempting decryption; otherwise, their decryptor won’t have access permissions. In some cases, even renaming file extensions manually is required after decryption due to permission errors.
What Nigra Doesn’t Do (Yet)
One unique aspect of Nigra is that, to date, the group has not leaked stolen data:
- There are no known data leak sites affiliated with Nigra.
- Victims are not threatened with data publication (unlike with Akira or Ransomhub).
That said, this doesn’t mean the threat is low—losing access to your operational data for days or weeks can be devastating to a small business.
How to Protect Yourself – Start With a Risk Assessment
Most Nigra incidents we’ve seen could have been avoided with basic preventative measures. That’s why we strongly recommend conducting a Risk Assessment with the Tictac Cyber Security team. Within 48 hours, we’ll help you:
- Identify exposed RDP/MSSQL services
- Audit and update weak credentials
- Check for backdoor user accounts
- Evaluate your backup strategy
- Simulate ransomware behavior against your infrastructure
How Tictac Cyber Security Can Help
Tictac has successfully handled numerous Nigra Ransomware attacks and offers comprehensive recovery and prevention services:
- 24/7 Incident Response
- Forensic analysis & root cause detection
- Decryption support (where possible)
- Data recovery & infrastructure restoration
- Backup hardening & network segmentation
- Legal-safe ransom negotiation assistance
Conclusion
Nigra Ransomware may not make international headlines, but for a small business, a single attack can be catastrophic. Without backups or a recovery plan, you could face operational downtime, data loss, and spiraling ransom demands—with no guarantee of resolution.
Don’t wait for a ransomware attack to test your defenses. Contact Tictac Cyber Security today to schedule your Risk Assessment and safeguard your business from one of the most deceptive ransomware threats circulating in 2025.
