Lilu (Lilocked) Ransomware Started Infecting Thousands of Linux Servers Back to Back
A new strain of ransomware named Lilocked or Lilu has affected thousands of Linux-based servers everywhere the world. The ransomware started infecting servers back in period of time however within the last two weeks, the attacks became a lot of frequent.
Quick answer: Lilocked, also called Lilu, is ransomware that targets Linux servers. It encrypts files, mostly on web servers, and leaves a ransom note. How it gains root access was unknown when it was reported. Defend by patching, using strong SSH credentials or keys, limiting exposed services and keeping tested offline backups.
Key takeaways
- Lilocked mainly hit Linux web servers and left a ransom note in encrypted folders.
- Keep offline backups and patch internet-facing software, because ransomware needs access first.
- Report incidents to CERT-In and do not assume paying will return your files.
The very first case of Lilocked ransomware came to light when a user uploaded a ransomware note on ID Ransomware, a website used for identifying the name of ransomware from the ransomware note or demand specified in the attack.
It targets servers and gains its root access. The mechanism behind however it gets access in unknown yet.
According to a Russian forum, bad actors might be targeting Linux-based servers that are running defunct Exim software.
Demand – 0.03 Bitcoin
After a server has been attacked, the files are locked with “.lilocked” file extension.
The note accompanied with the encrypted files reads: “I’ve encrypted all your sensitive data!!! It’s a strong encryption, so don’t be naive to restore it;)”
Upon clicking the link in the note, users are redirected to a website on the dark web, prompting them to enter the key in the note. When the affected user enters the key, they are asked to deposit 0.03 bitcoin or $325 in the Electrum wallet to get their files decrypted.
Lilock ransomware does not affect system files but files with extensions including HTML, SHTML, JS, CSS, PHP, INI, and other image formats. Since system files are not affected, Linux systems are running normally.
As per Benkow, a French security researcher, Lilock ransomware has affected 6,700 servers to date. Most of these servers are cached in Google search results. However, the number of infected servers can be far more as there ar several infected Linux servers that don’t seem to be indexed on Google.
Since the mechanism behind the ransomware isn’t well-known yet, there isn’t a security consultive. You might evade this attack by keeping strong passwords and updating the apps as and when security patches arrive.
To take this further with guided labs and an instructor, see our classroom Linux training.
Related reading
- Ransomware Revealed | A Step-by-Step Breakdown of How Attacks Happen
- What is the real risk behind malicious VSCode extensions like the Cursor IDE incident?
- What are the Firefox extensions that steal cryptocurrency wallets and how can I avoid them?
Reference
For the authoritative details, see CERT-In (India).
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
With a passion for staying on the cutting edge of technology trends, I am dedicated to delivering content that not only informs but also inspires. Whether you need in-depth analysis pieces, informative guides, or thought-provoking opinion pieces, I craft content that resonates with tech enthusiasts and professionals alike.
