Lilocked is a Linux-targeted malware that encrypts files on the hard drive and subsequently demands a ransom.
According to ZDNet, the first reports of the malware emerged in mid-July, and since then, over 6,700 servers have been affected. Lilocked encrypts files HTML, SHTML, JS, CSS, PHP, INI and various image formats, leaving system files untouched. Encrypted files receive the extension .lilocked, and in each directory containing such files, a text note appears #README.lilocked with a link to a Tor website, where the demand to pay 0.03 BTC (approximately $325) is posted.
The point of entry for Lilocked into the system is currently unknown. There is a presumed link to a recently patched critical vulnerability in Exim.
Source: linux.org.ru
