Thousands of Servers Infected With New Lilocked (Lilu) Ransomware

'Thousands of web servers have been infected and had their files
encrypted by a new strain of ransomware named Lilocked (or Lilu).
Infections have been happening since mid-July, and have intensified in
the past two weeks, ZDNet has learned. Based on current evidence, the
Lilocked ransomware appears to target Linux-based systems only. The
way the Lilocked gang breaches servers and encrypts their content is
currently unknown. A thread on a Russian-speaking forum puts forward
the theory that crooks might be targeting systems running outdated
Exim (email) software. It also mentions that the ransomware managed to
get root access to servers by unknown means.

Lilocked doesn't encrypt system files, but only a small subset of file
extensions, such as HTML, SHTML, JS, CSS, PHP, INI, and various image
file formats. This means infected servers continue to run normally.
According to French security researcher Benkow, Lilocked has encrypted
more than 6,700 servers, many of which have been indexed and cached in
Google search results. However, the number of victims is suspected to
be much much higher. Not all Linux systems run web servers, and there
are many other infected systems that haven't been indexed in Google
search results.

Why it should scare you:
- affects Linux servers
- so far the vector of infection / vulnerability is unknown
- you can craft a Google search to watch it spread! '

-- source: https://it.slashdot.org/story/19/09/09/2246218

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: %(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s