Lkhy Ransomware Will Encrypt Your Drives

After a thorough examination of new malware samples, we've identified Lkhy, a ransomware variant linked to the Djvu family. Lkhy encrypts files and alters their names by adding the ".lkhy" extension, for instance, transforming "1.jpg" into "1.jpg.lkhy" and "2.png" into "2.png.lkhy."

Additionally, Lkhy creates a ransom note presented as a text file named "_readme.txt," containing payment instructions and contact details. It's essential to highlight that Djvu ransomware attacks often involve the inclusion of information stealers like Vidar or RedLine.
The note specifies that a variety of files, including images, databases, and documents, have been encrypted using a robust algorithm. The sole avenue for recovery is obtaining a dedicated decrypt tool along with a unique key. The attackers demand a payment of $999 for access to these tools, enticing victims with a 50% discount if they reach out within a 72-hour timeframe.

Moreover, the cybercriminals suggest demonstrating their decryption capabilities by offering to decrypt one file at no cost, provided the submitted file lacks valuable information. The designated email addresses for communication are support@freshingmail.top and datarestorehelpyou@airmail.cc.

Table of Contents

Lkhy Ransom Note in Full

The complete text of the ransom note generated by Lkhy reads as follows, and outlines the new ransom sum usd by Djvu clones, amounting to $999 in ransom:

ATTENTION!

Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
Do not ask assistants from youtube and recovery data sites for help in recovering your data.
They can use your free decryption quota and scam you.
Our contact is emails in this text document only.
You can get and look video overview decrypt tool:
hxxps://we.tl/t-uNdL2KHHdy
Price of private key and decrypt software is $999.
Discount 50% available if you contact us first 72 hours, that's price for you is $499.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
support@freshingmail.top

Reserve e-mail address to contact us:
datarestorehelpyou@airmail.cc

Your personal ID:

How Can Ransomware Infect Your Computer?

Ransomware can infect your computer through various methods, and attackers often employ cunning techniques to exploit vulnerabilities. Here are common ways ransomware can infect your computer:

Phishing Emails: Attackers often use phishing emails to distribute ransomware. These emails may contain malicious attachments or links that, when clicked, download and execute the ransomware on your system.

Malicious Websites: Visiting compromised or malicious websites can expose your computer to ransomware. Some websites may exploit vulnerabilities in your browser or plugins to deliver the malware.

Malvertising: Cybercriminals may compromise online advertisements on legitimate websites to deliver ransomware. Clicking on an infected ad can trigger the download and execution of the ransomware on your computer.

Exploiting Software Vulnerabilities: Ransomware can exploit vulnerabilities in your operating system, software, or applications. If your system is not up-to-date with the latest security patches, attackers can take advantage of these weaknesses to install ransomware.

Drive-by Downloads: In a drive-by download attack, malware is automatically downloaded and installed on your computer when you visit a compromised or malicious website. This can happen without any action on your part.