Thousands of servers infected with the Lilocked Ransomware

A new ransomware tracked as Lilocked (or Lilu) by researchers is actively targeting servers and encrypting the data stored on them.

The Lilocked ransomware has already infected thousands of Linux-based web servers since mid-July.

The Lilocked ransomware was first reported at the end of July by the popular malware researcher Michael Gillespie after a sample has been  uploaded to his ID Ransomware service.

#Ransomware Hunt: extension ".lilocked", note "#README.lilocked" – https://t.co/cvaSXon1nN pic.twitter.com/mc2m8rsDFR

— Michael Gillespie (@demonslay335) July 20, 2019

The infection caused the encrypted files to appear in the Google search results.

According to the Tweet user Jay Gairson, who discovered that his web server, was compromised by this ransomware, the malware leverages an Exim exploit to target the servers.

Hit the server by order of last user logged in and that user's directories. Used an Exim exploit.

The affected system was taken offline and replaced, but a copy of it is preserved. Happy to see if the ransomware was actually stored on the drive rather than just in memory.

— Jay Gairson (@maztec) August 5, 2019

This thesis is also supported on a thread on a Russian-speaking forum that speculates the hackers have been targeting systems running outdated Exim software.

At the time of writing security experts are searching for a Lilocked sample to analyze to shed the light on its infection process.

The ransomware encrypts files and appends the .lilocked extension to the file name, then it drops a ransom note named #README.lilocked.

The ransom note instructs victims on how to make ransom payments through a Tor payment portal, it also includes a key to log in to the payment site.

The payment portal includes detailed instructions to pay the ransom, including the bitcoin address and ransom amount, that is approximately $100 USD worth of Bitcoin.

“At this time, there is no known way to decrypt files encrypted by Lilu, but if a sample is discovered that may change.” reads the post published by BleepingComputer.

“BleepingComputer has also reached out to the contact email listed on the Tor site with questions, but had not heard back at the time of this publication.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Lilocked, ransomware)

[adrotate banner=”5″]

[adrotate banner=”13″]