A new family of ransomware called Lilocked (or Lilu) infected thousands of web servers and encrypted their files.

According to ZDNet, users first began uploading ransom notes for Lilocked ransomware to ID Ransomware in mid-July 2019. Researchers found evidence of these attacks having intensified near the end of August. They also found that the ransomware mainly targeted a small subset of file extensions, including HTML, SHTML, JS, CSS, PHP and INI, hosted on Linux web servers. The means by which attackers gained access to these servers and encrypted their files remained unknown at the time of writing.

After Lilocked finished its encryption routine, each affected file sported .lilocked as its file extension. The ransomware also deposited a ransom note into each folder where it encrypted files. That message redirected victims to a payment portal on the darknet where a second ransom message demanded that victims pay 0.03 bitcoin (worth approximately $310).

The Latest Threat to Target Linux Servers

Lilocked isn’t the first threat family to target Linux servers. In February 2019, Bleeping Computer observed B0r0nt0K demanding as much as 20 bitcoins (then worth approximately $75,000) from Linux servers whose contents it had encrypted. A few months later, Intezer Labs discovered a new malware family called HiddenWasp targeting Linux severs for the purpose of achieving targeted remote control. More recently, in July 2019, Intezer Labs observed QNAPCrypt going after Linux-based file storage systems (NAS servers).

How to Defend Against Lilocked Ransomware

Security professionals can help defend their organizations against Lilocked ransomware by having a data backup strategy that enables backup accounts to access production systems, yet blocks production accounts from writing to any type of backup. Companies should link this backup strategy to a sophisticated data-centric solution that blends encryption, access controls and other security measures, thereby narrowing the attack surface for threats like ransomware.

More from

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect EnglishChatGPT is a public tool based on a language model created by…

4 min read

Now Social Engineering Attackers Have AI. Do You? 

4 min read - Everybody in tech is talking about ChatGPT, the AI-based chatbot from Open AI that writes convincing prose and usable code. The trouble is malicious cyber attackers can use generative AI tools like ChatGPT to craft convincing prose and usable code just like everybody else. How does this powerful new category of tools affect the ability of criminals to launch cyberattacks, including social engineering attacks? When Every Social Engineering Attack Uses Perfect EnglishChatGPT is a public tool based on a language model created by…

4 min read

Despite Tech Layoffs, Cybersecurity Positions are Hiring

4 min read - It’s easy to read today’s headlines and think that now isn’t the best time to look for a job in the tech industry. However, that’s not necessarily true. When you read deeper into the stories and numbers, cybersecurity positions are still very much in demand. Cybersecurity professionals are landing jobs every day, and IT professionals from other roles may be able to transfer their skills into cybersecurity relatively easily. As cybersecurity continues to remain a top business priority, organizations will…

4 min read

How I Got Started: White Hat Hacker

3 min read - White hat hackers serve as a crucial line of cyber defense, working to identify and mitigate potential threats before malicious actors can exploit them. These ethical hackers harness their skills to assess the security of networks and systems, ultimately helping organizations bolster their digital defenses. But what drives someone to pursue a career as a white hat hacker, and how do you get started in leveraging so-called “evil” skills for the greater good?? In this exclusive Q&A, we spoke with…

3 min read