StopAndProtect Ransomware: Files Encrypted and Data Stolen

Anyone who suddenly finds renamed, unreadable files and a lock-screen ransom demand after a fake CAPTCHA prompt on a website is most likely a victim of StopAndProtect. The ransomware encrypts files, locks input, steals data and spreads via SMB shares and connected USB storage devices. The data is usually physically intact – just no longer accessible.

StopAndProtect ransomware: files encrypted – what exactly happened

On 18 August 2026, Check Point Research published the analysis “Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect”. It describes an ongoing attack operation against Windows environments distributed via numerous compromised WordPress websites. According to the researchers, they became aware of the family in mid-May 2026.

The entry point is not a technical device fault but deliberate deception: a manipulated WordPress page displays a fake CAPTCHA or ClickFix prompt to Windows visitors. In the process, a hidden PowerShell command – PowerShell is the Windows command line – is copied to the clipboard, and the victim is tricked into executing that command themselves. After that, a multi-stage chain downloads further components.

The sequence documented by Check Point: ClickFix → PowerShell script 1 → PowerShell script 2 → .NET loader stage 1 → downloader/loader stage 2 → stage 3 functional modules. The third-stage modules include the encryptor SilentEncryptor, the NetworkShareScanner as an SMB and USB worm, a LockScreen module, a Credential Stealer for access credentials, a VBS Spreader and a chat component.

“SilentEncryptor is the ransomware component.” – Check Point Research

Two kinds of damage at once: encryption and data theft

What matters most for those affected is that StopAndProtect does not just lock files. The analysis documents a data theft component (SilentDataCollector) that generates file listings from local drives, removable media and network drives, and transmits selected data to the attackers in compressed and encrypted form. Among other things, Check Point found archives in open attacker directories containing desktop data, password files, wallet files, file listings, encryption logs and screen captures. In more recent variants, the researchers additionally observed keylogging, screen recording and functions for harvesting WhatsApp contacts.

This means: data recovery alone does not automatically close the incident. It must also be assumed that stored data and login credentials may have been exfiltrated, until an investigation proves otherwise.

How big is the incident?

• More than 6,000 unique IP addresses in attacker logs, as of 24 July 2026. Check Point itself points out that individual entries may come from sandboxes or security researchers – the figure indicates the order of magnitude but is not a confirmed count of individual victims.
• Country distribution in this evaluation: USA 1,852, Russia 630, India 630 unique IP addresses.
• Around 31,000 screen captures from an open attacker directory between mid-May and the end of July 2026.
• More than 700 archives containing data presumably stolen from victims in the same period.
• Lists of nearly 2,000 compromised WordPress domains – an infrastructure indicator, not a victim count.
• Some 400 different files from just under 200 unique infected machines; another directory contained more than 20,000 activity captures.

Is my device affected? Who and which systems are at risk

StopAndProtect is not the fault of a single manufacturer and not tied to a particular device series. According to the primary source, the following are affected:

• Windows endpoints and Windows-centric corporate environments. The source does not name a specific Windows version, model series or firmware. The ClickFix entry point targets Windows visitors; PowerShell and WMI (Windows Management Instrumentation, a management interface) are used in the attack chain.
• SMB network shares and reachable network resources. No specific SMB version is named. The NetworkShareScanner enumerates network shares; the VBS module can scan the network and create remote processes via WMI.
• Connected USB storage devices and other removable media. No manufacturers, models or firmware levels named – the scanner enumerates plugged-in USB devices, and the VBS module propagates to removable media.
• Compromised WordPress websites as abused distribution infrastructure. No generally vulnerable WordPress version is identified; one site examined was running a WordPress version from 2021.

How to recognise a StopAndProtect infection

• A website displays a supposed CAPTCHA or security check that asks you to paste or run a command in Windows. That is never a legitimate repair step.
• Your own files can no longer be opened and have been renamed. The primary source does not name a generally applicable file extension.
• The computer displays a lock screen with a ransom demand or payment QR code, and input no longer responds (LockScreen module).
• Files on SMB shares, network drives or USB media show similar signs of encryption.
• Corporate logs show unexpected PowerShell executions, unusual machine-to-machine connections or new remote processes.
• Data can be affected even without visible encryption – Check Point observed the operation in part as silent data theft.

How to check safely whether you are affected

1. Document instead of clicking. Note the time, device name, logged-in user, visible messages and the names of a few affected files – or photograph them with a separate phone. Do not run any commands from the website, and do not use the ransom chat function.
2. Disconnect the affected computer from the network. Unplug the network cable, disable Wi-Fi. CISA names the immediate isolation of affected systems as the first response step: “Determine which systems were impacted, and immediately isolate them.”
3. Do not switch off prematurely. CISA advises powering down only if network isolation is not possible – shutting down destroys volatile artefacts in memory.
4. Label USB media and set them aside. Do not plug any sticks, external hard drives or memory cards that were connected during the incident into other computers.
5. In companies: IOC review by specialists. The published StopAndProtect indicators (domains and SHA-256 hashes) are contained in the Check Point analysis and belong in the hands of IT or incident response professionals – not in manual execution by end users.
6. Forensic imaging before any clean-up. Have system and memory images as well as relevant logs secured before anything is cleaned up.
7. Identification checks only with copies. No More Ransom offers an identification service; this involves uploading files – the data protection decision is yours.

What you should do now – immediate measures without risk

1. Disconnect the device from LAN and Wi-Fi. If several systems or an entire segment are affected, IT must carry out isolation at switch or segment level.
2. Do not connect any further USB media. Keep storage devices that were already connected separately until they have been examined by specialists – the attack expressly includes SMB and USB propagation components.
3. Do not restart, do not reset, do not reinstall and do not start any automated clean-up.
4. Document everything: ransom demand, screenshots, names of encrypted files, timestamps, device and user names, existing backup versions.
5. Keep encrypted original files unchanged. Why this is particularly important in the case of StopAndProtect is explained in the next section.
6. In organisations, escalate immediately: involve IT security, incident response, management and – because of the documented exfiltration – data protection officers.
7. File a criminal complaint. The BSI recommends that those affected report the incident to the police without delay.
8. Paying a ransom is not a recovery strategy. The BSI makes it clear: “... wobei die Zahlung allerdings keinerlei Garantie für die Freigabe verschlüsselter Daten oder gesperrter Systeme bietet.” (“... whereby payment offers no guarantee whatsoever that encrypted data or locked systems will be released.”)
9. Only restore backups after containment and verification – accessible backups may also have been encrypted or deleted. If you want to review your backup strategy in general, the backup assistant provides structured guidance on prevention.

What you must never do – otherwise any decryption assessment is lost

In the case of StopAndProtect, this section is the most important one, because there is a particular circumstance here. Check Point researcher Jaromír Hořejší describes SilentEncryptor’s key derivation as follows:

“The key derivation function uses the per-file password and machine name to generate a 32-byte key.”

“Both per-file password and machine name are present in the name of the encrypted and renamed file, making decryption of files possible.”

In plain language: according to the analysis, the individual per-file password and the machine name are contained in the name of the encrypted, renamed file. This creates a technical possibility for carrying out an expert decryption assessment. It does not mean there is a generally available decryptor, nor is it any assurance that recovery will succeed – no officially confirmed StopAndProtect decryption tool is identified in the sources reviewed. All the more reason to observe the following:

• Never rename, delete, overwrite or format encrypted files. Any change to the file name may destroy exactly the information on which a later assessment could be based in the first place.
• Do not run any automatic repair, clean-up or “data recovery” programs on the affected storage device. Such tools write to the medium, rename files or move them to quarantine.
• No decryption or recovery tests on the only originals. An unaltered, read-only backup of the encrypted files and the ransom note must exist first.
• Do not switch off in an uncontrolled manner as long as clean network isolation is possible. CISA: “This step will prevent your organization from maintaining ransomware infection artifacts and potential evidence stored in volatile memory.”
• No reinstallation or factory reset before documentation and forensic imaging. Doing so destroys logs, memory state, malware samples and the ability to reconstruct the attack path.
• Do not continue using potentially infected USB storage devices or network shares and do not reconnect clean systems in an uncontrolled way – otherwise you will reinfect during the restore.
• If a physical defect in a storage device is also involved: no repeated start-up attempts, no mechanical repair attempts, no opening outside a suitable environment. No hardware defect is documented for StopAndProtect itself – these rules only apply where there is concurrent damage to a hard drive or SSD.

Experience shows it is not the attackers alone, but the well-intentioned rescue attempts of the first few hours – the quick rebuild, the renaming “to sort things out”, running a recovery tool on the same drive – that turn an assessable case into permanent data loss.

Why this case belongs in professional hands – and how RESQ specifically helps

With StopAndProtect there is no mechanical damage: the data is physically there, but encrypted, and the system is compromised. That is precisely what makes the case delicate. It is not about “somehow getting back to the files”, but about preserving the state of the system and the encrypted originals in such a way that a serious assessment remains possible at all.

What professional data recovery at RESQ does differently in this damage scenario compared with any attempt at your own desk:

• Work on a copy, never on the original. Affected storage devices are imaged first; all further analysis and attempts are carried out on the images. The original remains unchanged – and with it, the file name including the components relevant to StopAndProtect.
• Systematic collection of artefacts. Encrypted files, ransom note, renamed file names, malware remnants and logs are examined together. With this ransomware family, exactly these artefacts form the basis of any decryption assessment.
• Experience with ransomware cases spanning multiple devices. StopAndProtect spreads via SMB shares and USB media. As a result, it is often not just one notebook that is affected, but also network drives and connected storage – for server, RAID and NAS environments, data recovery for RAID and NAS is the appropriate route.
• A clear separation between recovery and returning to operation. A cleaned or rebuilt system is no substitute for secured data – and conversely, no one should restore recovered data into an environment that is still compromised. If defective hardware is also involved, repair at RESQ applies.

The process is deliberately designed to be risk-free for you: you describe your case, and RESQ carries out a free initial assessment and prepares a cost estimate. You receive an honest statement on the prospects – even if those prospects are poor. Only then do you decide whether the job goes ahead. If you would like to get started right away, you can create an order via your customer account.

With ransomware there is fundamentally no guarantee of successful decryption – every case is assessed individually. What you can control, however, is the starting position: anyone who leaves the encrypted originals untouched and leaves the assessment to professionals rules nothing out.

Is there a fix, an update or a decryptor?

As of the sources reviewed – the primary analysis was published on 18 August 2026 – there is no recall, no firmware update and no general vendor patch, because StopAndProtect does not exploit a single product vulnerability but uses social engineering plus built-in tools such as PowerShell and WMI. Likewise, no officially confirmed StopAndProtect decryptor is identified.

Defence consists of containing and cleaning the compromised Windows environment, checking the Check Point IOCs, blocking propagation across the network and removable media, removing the ClickFix entry point on affected websites, and restoring from verified offline backups. The historical SMB patch MS17-010 against WannaCry is expressly not a fix for StopAndProtect – what Check Point describes here is share and USB enumeration plus WMI propagation, not the exploitation of MS17-010.

Conclusion: overwrite nothing, have the case assessed

StopAndProtect is a serious case: file encryption, screen locking, data theft and propagation via SMB and USB in one package, distributed across thousands of compromised WordPress sites, with more than 6,000 unique IP addresses in the attacker logs as of the 24 July 2026 cut-off date. At the same time: the data is generally physically intact – merely inaccessible. And the analysis provides a technical starting point that makes an expert decryption assessment conceivable in principle, as long as the encrypted original files remain unchanged.

Hence the most important sentence in closing: disconnect the affected device from the network, change nothing, install nothing, rename nothing – and have your case assessed. Request your free initial assessment with cost estimate now and find out what options exist in your specific case, before do-it-yourself attempts destroy something that cannot be brought back.