September 9, 2019 By David Bisson 2 min read

A new family of ransomware called Lilocked (or Lilu) infected thousands of web servers and encrypted their files.

According to ZDNet, users first began uploading ransom notes for Lilocked ransomware to ID Ransomware in mid-July 2019. Researchers found evidence of these attacks having intensified near the end of August. They also found that the ransomware mainly targeted a small subset of file extensions, including HTML, SHTML, JS, CSS, PHP and INI, hosted on Linux web servers. The means by which attackers gained access to these servers and encrypted their files remained unknown at the time of writing.

After Lilocked finished its encryption routine, each affected file sported .lilocked as its file extension. The ransomware also deposited a ransom note into each folder where it encrypted files. That message redirected victims to a payment portal on the darknet where a second ransom message demanded that victims pay 0.03 bitcoin (worth approximately $310).

The Latest Threat to Target Linux Servers

Lilocked isn’t the first threat family to target Linux servers. In February 2019, Bleeping Computer observed B0r0nt0K demanding as much as 20 bitcoins (then worth approximately $75,000) from Linux servers whose contents it had encrypted. A few months later, Intezer Labs discovered a new malware family called HiddenWasp targeting Linux severs for the purpose of achieving targeted remote control. More recently, in July 2019, Intezer Labs observed QNAPCrypt going after Linux-based file storage systems (NAS servers).

How to Defend Against Lilocked Ransomware

Security professionals can help defend their organizations against Lilocked ransomware by having a data backup strategy that enables backup accounts to access production systems, yet blocks production accounts from writing to any type of backup. Companies should link this backup strategy to a sophisticated data-centric solution that blends encryption, access controls and other security measures, thereby narrowing the attack surface for threats like ransomware.

More from

Adversarial advantage: Using nation-state threat analysis to strengthen U.S. cybersecurity

4 min read - Nation-state adversaries are changing their approach, pivoting from data destruction to prioritizing stealth and espionage. According to the Microsoft 2023 Digital Defense Report, "nation-state attackers are increasing their investments and launching more sophisticated cyberattacks to evade detection and achieve strategic priorities."These actors pose a critical threat to United States infrastructure and protected data, and compromising either resource could put citizens at risk.Thankfully, there's an upside to these malicious efforts: information. By analyzing nation-state tactics, government agencies and private enterprises are…

6 Principles of Operational Technology Cybersecurity released by joint NSA initiative

4 min read - Today’s critical infrastructure organizations rely on operational technology (OT) to help control and manage the systems and processes required to keep critical services to the public running. However, due to the highly integrated nature of OT deployments, cybersecurity has become a primary concern.On October 2, 2024, the NSA (National Security Agency) released a new CSI titled “Principles of Operational Technology Cybersecurity.” This new guide was created in collaboration with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD SCSC) to…

Strela Stealer: Today’s invoice is tomorrow’s phish

12 min read - As of November 2024, IBM X-Force has tracked ongoing Hive0145 campaigns delivering Strela Stealer malware to victims throughout Europe - primarily Spain, Germany and Ukraine. The phishing emails used in these campaigns are real invoice notifications, which have been stolen through previously exfiltrated email credentials. Strela Stealer is designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. During the past 18 months, the group tested various techniques to enhance its operation's effectiveness. Hive0145 is likely to be…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today