Today, one of my end users using Windows 7 (for reference) got infected with a ransomware variant that weirdly enough doesn't seem to have changed the files's extensions.
Is this possible? Is there a mechanism to hide the extension? Because all files seem to be normal in that sense.
Based on the .txt and .png files with the message for the user, I think it might be a Cerber variant, but I'm not sure.