.wman / .bixi Ransomware: How to Save Files With Changed Extensions

.wman / .bixi Ransomware: How to Save Files With Changed Extensions

Late September, a printing factory in Tsuen Wan called in a panic: "Thousands of our AI (Illustrator) files got renamed to .wman overnight. Client deliveries are due tomorrow — we can't open anything!" I told them not to panic and asked step by step: any ransom note? Yes, called DECRYPT_INFO.html. Any backup? "We have NAS… but it's all .wman too."

That's .wman ransomware. Its twin .bixi emerged around the same time — many SMEs are hearing these names for the first time. Here's how to handle renamed extensions correctly.

How to recognise .wman / .bixi

• Extensions are replaced, not appended: Unlike .rox (appended), .wman/.bixi swap the original extension. poster.ai becomes poster.wman, not poster.ai.wman. This detail matters for later filename restoration.
• Ransom note is HTML: Not a plain .txt but DECRYPT_INFO.html — double-clicking opens a rather polished ransom page in the browser (criminals do UI too). Contains a victim ID and a Tor site link.
• Desktop wallpaper changed: Windows wallpaper becomes a black-and-red warning image — you know immediately.
• .wman vs .bixi: Same AES-256-CBC core, only the extension differs — probably different affiliates' "branding". Handled identically.

After extensions are changed: what NOT to do

Because extensions are replaced rather than appended, people get the wrong idea:

1. Don't manually rename .wman back to .ai: I know you're tempted, but it's useless. The content is AES-encrypted; renaming won't help. Worse — one client wrote a script to batch-rename thousands of files, destroying the original filename records. Even with a future decryptor, nobody knew which was which.
2. Don't open them / don't "try": Opening a .wman in Illustrator won't harm your PC, but wastes time. Definitely don't try shady "one-click decryptors" — 90% are fake, some are a second virus.
3. Record the mapping: Open an Excel sheet and note a few important files' "new name (.wman)" vs the "original name" you remember. You'll need this during restoration.

Any decryption hope?

Straight talk: no public free decryptor exists for .wman/.bixi yet. The AES-256-CBC implementation is solid with no known flaws.

But that doesn't mean nothing can be done:

• Design files have a special rescue: In the printing case, luckily Illustrator users routinely exported PDFs for client approval. PDFs aren't source files, but they're printable — good enough to deliver. We recovered 70% of the workload from emails.
• Cloud version history: Dropbox, Google Drive, OneDrive all keep version history! Even if local files are encrypted, open the old version in the cloud. The Tsuen Wan factory recovered plenty from Google Drive.
• Software auto-backups: Adobe apps keep auto-recovery caches in %AppData% — sometimes containing unencrypted temp files. Not always, but worth checking.
• Register on No More Ransom: As before — register and wait.

Real case: How the Tsuen Wan printer met its deadlines

Thousands of .ai files turned .wman, three client deliveries due next day. NAS backup was .wman too (permanently mounted, again).

We fought on three fronts:

1. Hunt PDFs: From emails, WeChat records and Google Drive, we found every proof PDF ever sent to clients. Not source files, but directly printable (printing doesn't need .ai — high-res PDF works). Saved two clients' orders.
2. Google Drive versions: One designer habitually kept work-in-progress on Google Drive with version history. Not final versions, but close enough to finish.
3. Third client: genuine rebuild: No PDF, no cloud — the designer pulled an all-nighter. He remembered the design roughly; delivered at 6 AM.

All three clients served on time. Cost: HK$9,800. The boss said: "HK$9,800 to keep three clients and the company's name — worth it." Afterwards we set up: Synology NAS with immutable snapshots, Google Drive real-time sync, and auto-export of finished designs to PDF in a separate folder (our idea — PDFs aren't source files, but they're a lifeline in emergencies).

Prevention: design industry take note

• Always export PDF/JPG archives of finished work: Don't keep only source files. PDFs can be printed and used even if they're not editable.
• Use cloud sync: Google Drive / Dropbox version history is a free "time machine" — turn it on.
• Separate storage: Work-in-progress → local + cloud sync; finished work → NAS (immutable) + external drive. Never all eggs in one basket.
• Know Adobe's temp paths: Illustrator/Photoshop auto-recovery locations can save you in emergencies.

FAQ

1. Q: Are .wman and .bixi the same virus?

A: Same encryption core, different extensions — likely different affiliates' "branding". Handled identically.

2. Q: If I rename .wman back to .ai, will Illustrator open it?

A: No. The content is AES-encrypted; renaming doesn't decrypt. Don't waste time, and be careful not to destroy filename records.

3. Q: The ransom note is HTML — safe to open?

A: Opening the HTML in a browser is safe (it's a static page). But don't click the Tor link inside, and don't open it on the infected machine — use a separate clean PC.

4. Q: Any special backup strategy for design files?

A: Yes — we recommend three layers: ① Work-in-progress → real-time cloud sync (Google Drive/Dropbox) ② Daily finished work → NAS (immutable) ③ Weekly → offline external drive. Plus auto PDF export. Bulletproof.

Summary

For "extension-swapping" ransomware like .wman/.bixi, the key is: don't fiddle with renaming, keep everything as-is, identify first, then plan. Designers — remember PDFs are your lifeline and cloud version history is a time machine. If hit, don't panic; take it step by step.

Need help? WhatsApp +852 6558 6806 — free malware identification. More info in our ransomware protection guide.