Normally, computer users are grateful when their antivirus software blocks suspicious files, but an emerging strain of ransomware is keeping them out of their system entirely and steals information unless they pay up.

First revealed in a blog post from security firm Trend Micro, the ransomware, known as CrypVault, acts as though it is legitimate antivirus software, quarantining files such as documents, images and databases. Those files are then encrypted with an RSA-1024 public and private key pair generated via GnuPG. Deleted files are then overwritten using Microsoft’s SDelete. When victims try to open their files, they see a ransom note demanding payment.

A story on Help Net Security noted the ransom messages appear to be in Russian, which may mean CrypVault is not yet being aimed at potential victims in North America or Europe. However, it could be highly dangerous if it spreads since it can also steal passwords and send them back to cybercriminals using the Browser Password Dump tool. The ransomware is also noteworthy because of how difficult it is for users to recover their files, with an estimated 16 overwrite passes with SDelete.

As its name suggests, CrypVault renames all the files it encrypts with a .vault extension. This makes it look even more like a legitimate AV tool, The Stack noted. Additionally, the cybercriminals making the ransom demands hide their identities with the Tor browser. Of course, most computer users can avoid all this so long as they aren’t tricked into clicking on a malicious JavaScript file that’s being distributed as an email attachment.

Best defined as malware that seeks not only information but financial gain by its perpetrators, ransomware has been cropping up more often lately. Just a few weeks ago, security experts revealed a strain known as TelsaCrypt. According to TechSpot, the malware has been seeking out and locking files within more than 50 popular video game systems. It demands amounts ranging from $500 to $1,000 within a 72-hour period — otherwise, it vows to permanently destroy them.

Consumers and businesses will likely be unsure of how best to handle a ransomware such as CrypVault. According to an opinion piece on BankInfoSecurity, however, giving in to the ultimatums is not the answer, since there is usually no way to guarantee cybercriminals will keep their word. Plus, if the attack targets a business, there will still be questions and issues to work out that may affect customers, even if payments are made. Loss of reputation may end up costing far more than these kinds of cybercriminals ever receive.