What file extensions does ransomware leave or change?

Many ransomware families rename encrypted files with a distinctive extension (such as .locky, .crypt, or family-specific strings) and drop ransom notes like README.txt or _DECRYPT_INSTRUCTIONS.html. These artifacts can be useful indicators, but they are unreliable as a detection method.

Modern variants increasingly encrypt files in place without changing extensions, or use intermittent encryption that leaves files looking normal. That is why Elastio detects ransomware by inspecting inside the file rather than relying on extensions or filenames, producing a deterministic verdict even when no visible marker exists.

Last updated May 27, 2026