What is a LILOCKED File Type?
The goal of the Lilocked Ransomware is to target web servers based on Linux-and d'exploit vulnerabilities in software running on the servers, including older Exim software. Once the virus gets root access, it takes the files from the servers hostage and forces the server administrators to pay the maintainer to unlock the files.
The ransom holds the files of the web server hostage by encrypting them and adding l'extension.lilocked to extensions of the files. For example, a sample.css becomes sample.css.lilocked.
In general, it does not encrypt server files, but only web files @ - @, such as .HTML, .CSS, .PHP and .JS files. After encrypting the files, it generates a ransom note (# README.lilocked) in each server folder to inform the server administrators of the takeover and the steps needed to recover the files.
There is currently no program available to efficiently open or restore LILOCKED files on a server. However, the administrator can restore the server from a previous backup to delete infected files and the Lilocked virus.
In July 2019, LILOCKED files became commonplace.