.taps / .enzo Ransomware: Encrypted File Recovery in Practice

.taps / .enzo Ransomware: Encrypted File Recovery in Practice

Late August, a renovation contractor in Tsing Yi switched on their PC to print drawings for the site — hundreds of CAD files (.dwg) in the project folder, all renamed with a .taps extension. The project manager called the boss; the boss called us: "Site work starts tomorrow. No drawings, no work — the workers will just stand around!"

.taps and .enzo specifically target design, engineering and construction firms. Why this sector? One fatal weakness: deadlines. Sites don't wait — criminals exploit delivery pressure to force quick payment. Here's the practical response.

Why target design and engineering?

• Construction / renovation / engineering: CAD drawings (.dwg, .dxf), BIM models. These files are huge (tens of MB to GB) and form the project's core.
• Design / advertising: Large PSDs and AI files. Similar to the .wman case, but .taps/.enzo also encrypt font files and asset libraries.
• Common trait: These industries share huge files, high volumes and tight deadlines. Criminals don't need data theft for double extortion — "you deliver tomorrow" pressure alone suffices.

.taps and .enzo differ mainly in extension; the AES-256 core is the same. Notably, their ransom notes are written in Traditional Chinese (not Simplified) — clearly targeting Hong Kong/Taiwan. We've seen notes opening with: "你好，你嘅檔案已經被加密……" — criminals do localisation too.

How do they infect design firms?

• Constant large file transfers: Clients send huge zips and rars; staff open them without thinking. Criminals disguise malware as "drawing packages". The Tsing Yi case started with a "flat layout.zip" from a supposed "property owner".
• Old software versions: AutoCAD 2018, Photoshop CS6 — known vulnerabilities in old software; malicious .dwg files trigger buffer overflows on open. Don't think "just opening a drawing is safe".
• No version control: Many small firms keep a single "final.dwg" — save over it, old versions gone. One encryption and everything's lost. The deadliest habit.
• External drives permanently plugged in: Designers leave 2TB drives connected for convenience — one infection takes the backup too.

Practical recovery: CAD files have special rescues

• AutoCAD auto-backup (.bak): AutoCAD creates .bak files (previous versions) in the same folder by default. If the malware encrypted .dwg but missed .bak (sometimes happens), rename .bak to .dwg and open. In Tsing Yi we found a dozen .bak files across folders, saving some drawings.
• PDF outputs: Like the printing case — check for PDFs previously issued to clients/sites. Sites work from PDFs, not CAD sources. With PDFs, workers can start.
• Email attachments: Design firms constantly email drawings; Gmail may hold older versions. Slow to search one by one, but effective.
• The draughtsman's PC: Sometimes not the whole office is hit. If the draughtsman didn't open that email, isolate their PC immediately — their files are the latest clean versions.

Real case: Tsing Yi contractor saves site drawings in 24 hours

Hundreds of CAD files turned .taps, site starting tomorrow. Extremely urgent.

We went on-site immediately, racing the clock:

1. Hour 1: find clean versions: Checked each PC — draughtsman Ah Keung's PC was clean (he was on leave, machine off). It held last Friday's complete project — a week old, but 90% there.
2. Hour 2: find PDFs: Retrieved the latest client-issued PDFs from email — newest versions (not CAD, but buildable).
3. Hours 3–6: merge and rebuild: Cross-referenced Ah Keung's CAD (a week old) with PDFs (latest), updating drawing by drawing. Luckily the project wasn't huge — done overnight.
4. 7 AM next day: Drawings printed, workers started on time. The boss said: "I thought I'd have to tell the client about delays. We made it."

Cost: HK$6,500 (emergency callout + overnight rescue). Afterwards we set up: Google Drive real-time sync on every draughting PC, AutoCAD 10-minute autosave, nightly NAS backup (immutable). The boss now personally checks backups on the first Monday of each month: "Lesson learned."

Prevention: design/engineering must-dos

1. Real-time cloud sync: Google Drive, OneDrive or Dropbox — sync the work folder. Changes upload instantly, no manual backup needed.
2. Version control habit: Never a single "final.dwg". Date your files: plan_20261008.dwg, one version daily. Don't delete old versions — they're your time machine.
3. PDF archives: Every client/site issue, save a PDF copy elsewhere. Not source files, but enough in emergencies.
4. Don't open archives blindly: Scan client-sent zips with antivirus first. Unknown sender? Call to verify.
5. Keep software updated: Don't run ancient AutoCAD/Adobe. Subscriptions cost, but include security updates.

FAQ

1. Q: Are .taps and .enzo the same?

A: Same core, different extensions. Ransom notes in Traditional Chinese, clearly targeting HK/Taiwan. Handled identically.

2. Q: CAD files are huge — won't cloud sync be slow?

A: First sync is slow (several GB takes hours), but afterwards only changed portions sync — fast. Leave the PC on overnight for the initial sync.

3. Q: Where are AutoCAD .bak files?

A: Same folder as the .dwg by default, same filename with .bak extension. Rename to .dwg to open. Enable "show file extensions" in Explorer to see them.

4. Q: Site's waiting — any faster emergency fix?

A: Yes. If you find PDFs, print them for workers — no need to wait for CAD restoration. PDFs aren't source files, but sufficient for construction. This trick has saved many cases.

Summary

.taps/.enzo exploit the design/engineering sector's "deadline" Achilles' heel. Key responses: maintain version control + cloud sync normally; if hit, don't panic — find clean versions first (colleague's PC, cloud, PDFs), then rebuild. Remember, deadlines are the criminals' weapon, but good backup habits neutralise it.

Hit with a deadline looming? WhatsApp +852 6558 6806 immediately — we have emergency case experience. For prevention, see our ransomware protection guide.