.SAGE File Extension

In December 2016, users began reporting the existence of Sage ransomware. In January 2017, a new variant of Sage, named Sage 2.0, began infecting users' computers.

Both versions of Sage encrypt a targeted set of a user's files, including documents, images, videos, and databases. The ransomware then appends the .sage extension to all encrypted files, deletes the user's Windows Shadow Volume Copies (to prevent users from recovering their files using a System Restore), and pops up a ransom note. Sage also adds the ransom note's text to the user's Windows desktop background. (FileInfo recommends you never pay a ransom to decrypt your files.)

How did my computer get infected by Sage ransomware?

Sage ransomware is most often distributed via spam emails that do not contain a subject but do contain a .ZIP attachment. This attachment contains another ZIP file, which in turn contains a .JS, .DOC, or .DOCX file. If you open the JS, DOC, or DOCX file and run the script or macro it contains, Sage infects your computer.

Currently, there is no way to decrypt SAGE files or restore them to their original state. The best option to retrieve your files (and remove Sage ransomware from your computer) is to restore your data from a backup created before your PC became infected by Sage ransomware. (Because Sage attempts to delete your PC's backup data, you may have to restore from a backup stored on an external hard drive or cloud server.)