Karma Ransomware Group — How to Remove Karma_V2 Virus?

What is known about the Karma Group?

Karma will append its extra .KARMA_V2 extension to every file’s title. For instance, a file entitled “photo.jpg” will be turned into “photo.jpg.KARMA_V2”. Likewise, the Excel sheet with the name “table.xlsx” will become “table.xlsx.KARMA_V2”, and so on.

In every folder with the encrypted files, a KARMA_V2-ENCRYPTED.txt notebook document will be found. It is a ransom money memo. Therein you can find information on the ways of paying the ransom and some other information. The ransom note most probably contains instructions on how to purchase the decryption tool from the racketeers. You can get this decoding tool after contacting , , via email. That is it.

The KARMA_V2-ENCRYPTED.txt document accompanying the Karma ransomware states the following:

Your network has been breached by Karma ransomware group.
We have extracted valuable or sensive data from your network and encrypted the data on your systems.

Decryption is only possible with a private key that only we posses.
Our group's only aim is to financially benefit from our brief acquaintance,this is a guarantee that we will do what we promise.
Scamming is just bad for business in this line of work.

Contact us to negotiate the terms of reversing the damage we have done and deleting the data we have downloaded.
We advise you not to use any data recovery tools without leaving copies of the initial encrypted file.
You are risking irreversibly damaging the file by doing this.

If we are not contacted or if we do not reach an agreement we will leak your date to journalists and publish it on our website.
hxxp://

If a ransom is payed we will provide the decryption key and proof that we deleted you data.
When you contact us we will provide you proof that we can decrypt your files and that we have downloaded your data.

How to contact us:

In the screenshot below, you can see what a directory with files encrypted by the Karma looks like. Each filename has the “.KARMA_V2” extension added to it.

How did my machine catch Karma ransomware?

There are currently three most exploited methods for hackers to have the Karma virus acting in your digital environment. These are email spam, Trojan introduction and peer file transfer.

If you open your mailbox and see emails that look just like notifications from utility services companies, postal agencies like FedEx, web-access providers, and whatnot, but whose addresser is strange to you, be wary of opening those letters. They are most likely to have a harmful file attached to them. So it is even more dangerous to download any attachments that come with emails like these.

Another thing the hackers might try is a Trojan horse scheme³. A Trojan is a program that gets into your computer pretending to be something different. For instance, you download an installer for some program you want or an update for some program. But what is unboxed turns out to be a harmful program that corrupts your data. Since the update file can have any name and any icon, you have to make sure that you can trust the source of the stuff you’re downloading. The optimal thing is to use the software developers’ official websites.

As for the peer file transfer protocols like BitTorrent or eMule, the danger is that they are even more trust-based than the rest of the Internet. You can never guess what you download until you get it. Our suggestion is that you use trustworthy websites. Also, it is a good idea to scan the folder containing the downloaded items with the anti-malware utility as soon as the downloading is finished.