New Lilocked Ransomware Discovered in The Wild

  •  
  •  
  •  
  • 2
  •  
  •  
  •  
    2
    Shares

Another ransomware has made it to the news that  is actively exploiting servers. Dubbed as Lilocked (or Lilu), the ransomware encrypts files stored on servers, including Linux servers. The attack vector, however, remains undetermined yet.

Lilocked Ransomware Attacking Servers

Researcher Michael Gillespie has pointed out a new ransomware variant. Identified as ‘Lilocked’ owing to the ‘.lilocked’ extension with which it encrypts the files, the ransomware is already active in the wild since July this year.

The researcher discovered this ransomware when he found its sample on his malware identifying service ‘ID ransomware’.

Until recently, Google shows over 6000 servers infected with Lilocked that also appear on Google search results.

The ransomware presently seems active for targeting Linux servers. Moreover, it is also infecting websites according to BleepingComputer and the files they have analysed.

Nonetheless, according to ZDNet, this can’t be taken for granted as not all Linux systems run web servers. Plus, many infected systems do not appear in Google search results.

Malware Entry Point Undetermined

Unfortunately, not much information is available regarding Lilu ransomware. This also includes the mode of entry of the malware to the target systems. One of the Lilocked victims suspected that the malware may exploit Exim to target servers.

As per the details known until now, upon entering a target device, it begins encrypting files with ‘.lilocked’ extension. It then places a copy of the ransom note ‘#README.lilocked’ in every folder it encrypts. The note directs the victim to the attacker’s Tor site for paying the ransom. This site also requires the visitor to enter a key mentioned in the ransom note.

The ransom demanded remains in an average user “payable” range, as the attackers asked for something between 0.01 or 0.03 Bitcoins (around 100 to 300 USD).

What makes Lilu different from other ransomware is that it does not encrypt system files. Rather it basically targets a small subset of file extensions such as .shtml, .jpg, and php.ini files (as observed from the samples).

For now, since the attack vector of the ransomware remains unknown, server owners must ensure robust generic security to prevent such attacks.

The following two tabs change content below.
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]
Avatar

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!