LockFile Ransomware Compromises Microsoft Exchange Servers
Over the past few months, cybercriminals have been actively targeting Microsoft Exchange servers. Multiple malware creators and ransomware operators are abusing recent vulnerabilities to take over exploitable servers and then plant their malicious apps on them. One of the latest vulnerabilities that crooks exploit is ProxyShell and, unfortunately, their attempts have been successful so far. The gang behind the LockFile Ransomware is abusing these exact vulnerabilities to run the dangerous file-encryption Trojan.
The ProxyShell vulnerabilities first surfaced a few months ago, and they were officially patched by Microsoft in May. However, there are still plenty of unpatched Microsoft Exchange servers that are open to the Internet. The criminals are using special tools to scan the Web and find servers running the outdated versions that still have the ProxyShell vulnerabilities. Another ransomware family to go after Microsoft Exchange servers recently has been the Epsilon Red Ransomware.
How is the LockFile Ransomware Planted?
Once the attackers exploit a Microsoft Exchange Server successfully, they plant a previously unknown web shell. It enables them to execute remote commands and control various features on the systems they compromise. Of course, in this case, the primary purpose of the web shell is to ensure the smooth execution of the LockFile Ransomware.
Once the file-locker gets to work, it will quickly encrypt the contents of valuable files stored on the machine. The threat appends the '.lockfile' extension to files it damages, and it also drops a ransom note to provide the victim with instructions. The message typically includes the name of the victim - <VICTIM NAME>-LOCKFILE-README.hta. The message inside reveals the situation to the victim and proposes a paid data recovery option. The criminals seem to be eager to get the money, and they list two important conditions:
- Victims who pay in 24 hours will get a 50% discount.
- Victims who fail to pay within 48 hours will have their files permanently deleted.
It is not clear whether the attackers are bluffing or not. They advise their victims to contact them via the email contact@contipauper.com or via the Tox messaging client. It is a bad idea to try to co-operate with the criminals. They give you no reason to trust them, and it would be very easy for them to scam you out of your money. Victims of the LockFile Ransomware should use an antivirus tool to terminate the malware and then recover their files through a backup.
