Thousands of Linux servers infected with new Lilocked (Lilu) ransomware

[J65nko]

From https://www.zdnet.com/article/thousa...lu-ransomware/ :

Researchers spot new ransomware targeting Linux-based servers

Thousands of web servers have been infected and had their files encrypted by a new strain of ransomware named Lilocked (or Lilu).
...
Based on current evidence, the Lilocked ransomware appears to target Linux-based systems only.
...
The way the Lilocked gang breaches servers and encrypts their content is currently unknown. A thread on a Russian-speaking forum puts forward the theory that crooks might be targeting systems running outdated Exim (email) software. It also mentions that the ransomware managed to get root access to servers by unknown means.

Servers hit by this ransomware are easy to spot because most of their files are encrypted and sporting a new ".lilocked" file extension