A new family of ransomware called Lilocked (or Lilu) infected thousands of web servers and encrypted their files.
According to ZDNet, users first began uploading ransom notes for Lilocked ransomware to ID Ransomware in mid-July 2019. Researchers found evidence of these attacks having intensified near the end of August. They also found that the ransomware mainly targeted a small subset of file extensions, including HTML, SHTML, JS, CSS, PHP and INI, hosted on Linux web servers. The means by which attackers gained access to these servers and encrypted their files remained unknown at the time of writing.
After Lilocked finished its encryption routine, each affected file sported .lilocked as its file extension. The ransomware also deposited a ransom note into each folder where it encrypted files. That message redirected victims to a payment portal on the darknet where a second ransom message demanded that victims pay 0.03 bitcoin (worth approximately $310).
The Latest Threat to Target Linux Servers
Lilocked isn’t the first threat family to target Linux servers. In February 2019, Bleeping Computer observed B0r0nt0K demanding as much as 20 bitcoins (then worth approximately $75,000) from Linux servers whose contents it had encrypted. A few months later, Intezer Labs discovered a new malware family called HiddenWasp targeting Linux severs for the purpose of achieving targeted remote control. More recently, in July 2019, Intezer Labs observed QNAPCrypt going after Linux-based file storage systems (NAS servers).
How to Defend Against Lilocked Ransomware
Security professionals can help defend their organizations against Lilocked ransomware by having a data backup strategy that enables backup accounts to access production systems, yet blocks production accounts from writing to any type of backup. Companies should link this backup strategy to a sophisticated data-centric solution that blends encryption, access controls and other security measures, thereby narrowing the attack surface for threats like ransomware.