I have been attacked with a ransom malware, with all my files converted into .besub extension. And the hacker left a note and asking for ransom.

Obviously the data is important and I want it back.

Note that, my OS is genuine Windows 10. And i was using Defender, for protection (WHICH IS obviously, you know what i mean). But still, isn't the responsibility should be taken by Microsoft? What they can do in that?

And what should I do to get my data back?

I can provide you a sample file if you ask.

closed as off-topic by forest, Xander, Tobi Nary, Steffen Ullrich, Royce Williams Jul 7 at 2:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – forest, Xander, Tobi Nary, Steffen Ullrich, Royce Williams
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Hindsight is 20/20, but the best protection against ransomware (as well as lots of other loss-of-data scenarios) is to have proper backups of all your important data. – Philipp Jul 2 at 16:04
  • 1
    Now that you've been infected, they probably can't do anything. Ransomware normally uses strong encryption. In the future, keep better backups -- malware is only one reason why. If you back up your data regularly, you're protected from anything that damages your data, whether it's dropping your computer into a river, viruses, particularly technically illiterate family, whatever. – Nic Hartley Jul 2 at 16:16
  • 2

Although there have been poorly implemented ransomware attacks in the past that have been broken, I haven't seen that in a while so it's unlikely you can break it. Nevertheless it's worth googling.

That said, here's a method that may provide partial recovery of critical files.

Generally the ransomware attacks don't touch Windows Shadow Volumes. Get yourself a shadow volume tool like ShadowExplorer.

Export what critical files you can from ShadowExplorer. These will be back level files missing their most recent updates. There may be many versions, in which case you likely want the most recent file but check all the volumes, or there may be none.

Good Luck and let us know your results!

Not the answer you're looking for? Browse other questions tagged or ask your own question.