Lexus Ransomware: Another Threat to Your Data

Ransomware attacks have become increasingly sophisticated and damaging, with Lexus Ransomware being a recent addition to the list of threats. This malware encrypts files, renames them, and demands a ransom for decryption. Understanding how Lexus Ransomware operates and how to protect against it is crucial for individuals and organizations.

What is Lexus Ransomware?

Lexus Ransomware is malicious software designed to encrypt files on the victim's computer, making them inaccessible until a ransom is paid. It belongs to the notorious Phobos ransomware family, just like Carver Ransomware and Dzen Ransomware. Like other ransomware, it uses encryption to lock users out of their data, but it also renames files by appending the victim's ID, an email address (emily.florez@zohomail.com), and the ".Lexus" extension to the filenames. For instance, "picture.png" becomes "picture.png.id[9ECFA84E-3506].[emily.florez@zohomail.com].Lexus."

How Does Lexus Ransomware Operate?

Once Lexus Ransomware infects a system, it generates two ransom notes ("info.txt" and "info.hta") to inform victims that their data has been encrypted and downloaded. The ransom note instructs victims to use specified software to decrypt their data and warns against trying to decrypt files using third-party software, as this could result in permanent data loss. The note also threatens that failure to respond within two days will lead to the data being sent to interested parties. Victims are provided with two email addresses (emily.florez@zohomail.com and barbara.li@gmx.com) for contact and are advised not to rename the encrypted files.

An example of the Lexus Ransomware ransom text:

Your data is encrypted and downloaded!

Unlocking your data is possible only with our software.
Important! An attempt to decrypt it yourself or decrypt it with third-party software will result in the loss of your data forever.
Contacting intermediary companies, recovery companies will create the risk of losing your data forever or being deceived by these companies.
Being deceived is your responsibility! Learn the experience on the forums.

Downloaded data of your company.

Data leakage is a serious violation of the law. Don't worry, the incident will remain a secret, the data is protected.
After the transaction is completed, all data downloaded from you will be deleted from our resources. Government agencies, competitors, contractors and local media
not aware of the incident.
Also, we guarantee that your company's personal data will not be sold on DArkWeb resources and will not be used to attack your company, employees
and counterparties in the future.
If you have not contacted within 2 days from the moment of the incident, we will consider the transaction not completed.
Your data will be sent to all interested parties. This is your responsibility.

Contact us.

Write us to the e-mail:emily.florez@zohomail.com
In case of no answer in 24 hours write us to this e-mail:Barbara.li@gmx.com
Write this ID in the title of your message: -
If you have not contacted within 2 days from the moment of the incident, we will consider the transaction not completed.
Your data will be sent to all interested parties. This is your responsibility.

Do not rename encrypted files
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

What Does Ransomware Do?

Ransomware like Lexus encrypts files on both local and network-shared drives, rendering them unusable without the decryption key, which the attackers hold. Phobos ransomware variants, including Lexus, are known for additional malicious activities such as disabling firewalls, erasing Volume Shadow Copies, and establishing persistence on the infected system. This persistence is achieved by duplicating themselves in specific directories and registering with designated Run keys in the Windows registry. Additionally, these ransomware variants often gather location data and may exclude certain locations from encryption.

What Do Ransomware Attackers Want?

The primary goal of ransomware attackers is to extort money from their victims.They demand a ransom in exchange for the decryption key required to unlock the encrypted files. However, paying the ransom is risky and not advised, as there is no assurance that the attackers will supply the decryption tools even after receiving the payment. Furthermore, succumbing to ransom demands only encourages continuing these criminal activities.

Preventative Measures Against Ransomware Attacks

Given the increasing threat of ransomware, taking proactive steps to protect your data and systems is essential. Here are some preventative measures to consider:

1. Regular Backups: Maintain regular backups of important files on a remote server or an unplugged storage device. This ensures you have access to your data even if it is encrypted by ransomware.
2. Up-to-Date Software: Ensure that your operating system and all installed software are up-to-date with the latest security patches. Developers often release updates to fix vulnerabilities that malware could exploit.
3. Strong Passwords: Use strong, unique passwords for all accounts and change them regularly. Implementing multi-factor authentication adds another security layer to your data.
4. Secure RDP Services: If you use Remote Desktop Protocol (RDP), ensure it is properly configured and secured. Disable RDP if it is unnecessary, and use strong passwords and two-factor authentication to protect RDP accounts.
5. Email Caution: Be cautious with email attachments and links. Do not open attachments or click on links from unknown or suspicious sources.
6. Antivirus Software: Install reputable antivirus software and keep it updated. Regularly scan your system for malware.
7. Network Security: Protect your network with firewalls and intrusion detection systems. Monitor network traffic regularly for unusual activity.
8. User Training: Educate users about the dangers of ransomware and the importance of following security best practices. Awareness can prevent accidental downloads of malicious software.

Final Thoughts

Lexus Ransomware, a member of the Phobos ransomware family, poses a significant threat to data security through its file encryption and ransom demands. Understanding ransomware's operation and implementing preventative measures can help protect against these attacks. Regular backups, software updates, strong passwords, secure RDP services, email caution, antivirus software, network security, and user training are all critical components of a robust defense strategy against ransomware.