Black Kingdom

Black Kingdom, also known as GAmmAWare, is a malicious program classified as ransomware. Systems infected with this malware undergo data encryption and users receive ransomware demands for decryption tools. When Black Kingdom performs encryption, the names of the affected files are supplemented with the ".DEMON" extension. For example, a file originally named "1.jpg" becomes "1.jpg.DEMON" after encryption. After this process is completed, a ransomware message is created in a full-screen pop-up window and "README.txt" text files, which are dropped into the compromised folders. The ransomware message (in the pop-up window and "README.txt" files) informs victims that they have been attacked by the GAmmA group and reassures them that their data can be recovered.