A ransom note on a hostel laptop — and the one mistake the attacker made
Short answer: A Lenovo IdeaPad 3 arrived with a ransom note demanding ₹12,000 in Bitcoin for decryption. The laptop was used by four engineering students in a shared hostel room. Files with extensions .docx, .pdf, and .jpg had been renamed with an appended random-looking extension. On the bench: the ransomware variant was identified as a STOP/DJVU derivative (a prolific family targeting home and student users) that used an offline encryption key seeded from the machine’s hostname. The hostname was the default Lenovo factory value — predictable. Files were recovered without paying any ransom. Total cost: ₹5,500.
The technical path through the case
Identifying the ransomware variant
The ransom note format, the file extension pattern, and the encryption metadata embedded in the first 5 bytes of a sample encrypted file were sufficient to identify the variant. STOP/DJVU is a large family of ransomware that has been deployed extensively in India, Southeast Asia, and Eastern Europe. When the victim’s machine was offline during the encryption process (which happens when the attacker’s command-and-control server is unreachable), many older STOP/DJVU variants fall back to an offline encryption key — a static key embedded in the ransomware binary itself rather than a unique key generated per victim. Security researchers have published the offline keys for many of these variants. The NoMoreRansom project and STOPDecrypter tool database were checked. A matching offline key was confirmed.
Recovery and OS clean install
The decryption ran over 4 hours for approximately 180GB of files. Recovery rate: 94% of files fully decrypted; 6% were corrupted beyond recovery (a known limitation of offline-key decryption when the victim had intermittent internet access during encryption, causing a mix of offline and online encryption). The recovered 94% included all the academic project files the students were most concerned about. A clean Windows reinstall on a wiped drive followed, with the recovered files transferred to an external SSD first. See our related guide on ransomware data recovery and the shadow copy recovery technique for cases where no decryptor is available.
How the ransomware entered
Investigation of the browser history (accessible in memory from the last session before encryption) pointed to a file named Adobe_Premiere_Pro_2026_crack.exe downloaded from a torrent indexer. The executable was signed with a fake certificate and had been scanned clean by three online scanners three months earlier (before its signature was added to antivirus databases). Cracked software downloads are the single most common ransomware entry vector on Indian student laptops. For a broader set of software-related security failure patterns, see our notes on DIY laptop repair gone wrong for what happens when students attempt fixes without the right knowledge.
Prevention for shared hostel laptops
For shared-use machines: enable Windows Update automatic installation, use the free Microsoft Defender (built into Windows 11 and adequate for most threats), set a separate limited user account for general use and only use the admin account for software installation, and never install cracked software. An external SSD with a weekly backup takes 15 minutes to set up and removes ransom demands as a decision problem entirely — if files are backed up, the response to ransomware is a clean reinstall and restore, with zero payment and zero negotiation required.
When to call a laptop repair service (and what it costs in India)
Signs to act on
If your files have been renamed with an unfamiliar extension and a text note has appeared asking for payment, power off the laptop immediately. Do not connect any external drives or USB devices. Bring it in for variant identification before paying anything — in a meaningful percentage of cases, free recovery is available.
Typical repair cost in India
Ransomware variant identification and decryptor check: ₹2,000–₹3,500. File decryption using available key (time charge): ₹3,000–₹6,000. OS reinstall + security hardening: ₹2,500–₹4,500. Full data recovery service page for all scenarios.
A note from the LRW Engineer Team
The correct first question after ransomware is not “how do I pay?” but “which variant is this?” The second question is “is a decryptor available?” The ransom demand is designed to create urgency and bypass that reasoning. In this case, an attacker collected no money because a lazy implementation choice — using the factory hostname as the key seed — made the key predictable. Zero ransom paid. 94% of files recovered.