Locknet Ransomware Will Hold Your System Hostage

Locknet ransomware was identified through an analysis of new malware samples. Its main purpose is to encrypt files, rendering them inaccessible. Additionally, Locknet changes file names by appending the ".locknet" extension and delivers a ransom note named "HOW_TO_BACK_FILES.html."

An illustration of Locknet's file renaming: it alters "1.jpg" to "1.jpg.locknet," "2.png" to "2.png.locknet," and so on. Another significant aspect of this ransomware is its association with the MedusaLocker family.

The ransom note notifies victims that their network has been compromised, and all crucial files have been encrypted with RSA and AES encryption. It advises against using third-party software for file restoration, as this may cause permanent damage. The attackers claim exclusive decryption capabilities.

Furthermore, the note contains a threat to disclose highly sensitive data unless the ransom is paid promptly. The attackers assert that their primary motivation is financial gain, not damaging the victims' reputation. They offer to decrypt 2-3 unimportant files at no cost to demonstrate their decryption ability.

Contact details (crypt_group@outlook.com and uncrypthelp@yahoo.com email addresses) for negotiations are provided, along with a warning that the ransom amount will increase if not contacted within 72 hours.

Locknet Ransom Note in Full

The complete text of the Locknet ransom note reads as follows:

• YOUR PERSONAL ID:
• YOUR COMPANY NETWORK HAS BEEN PENETRATED
  All your important files have been encrypted!
• Your files are safe! Only modified. (RSA+AES)
• ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
  WILL PERMANENTLY CORRUPT IT.
  DO NOT MODIFY ENCRYPTED FILES.
  DO NOT RENAME ENCRYPTED FILES.
• No software available on internet can help you. We are the only ones able to
  solve your problem.
• We gathered highly confidential/personal data. These data are currently stored on
  a private server. This server will be immediately destroyed after your payment.
  If you decide to not pay, we will release your data to public or re-seller.
  So you can expect your data to be publicly available in the near future..
• We only seek money and our goal is not to damage your reputation or prevent
  your business from running.
• You will can send us 2-3 non-important files and we will decrypt it for free
  to prove we are able to give your files back.
• Contact us for price and get decryption software.
• If you can not use the above link, use the email:
  crypt_group@outlook.com
  uncrypthelp@yahoo.com
  To contact us, create a new free email account on the site: protonmail.com
  IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

How Can Ransomware Infect Your System?

Ransomware can infect your system through various methods and attack vectors. Here are some common ways in which ransomware can infiltrate your system:

• Phishing Emails: One of the most common methods is through malicious email attachments or links. Cybercriminals send deceptive emails that appear legitimate, encouraging recipients to open an attachment or click on a link that contains the ransomware payload.
• Malicious Websites: Visiting compromised or malicious websites can also expose your system to ransomware. Drive-by downloads can occur when you visit such sites, leading to the automatic download and execution of ransomware.
• Exploiting Vulnerabilities: Ransomware can exploit vulnerabilities in your operating system, software, or plugins. Outdated or unpatched software is particularly susceptible to these types of attacks.
• Malvertisements: Malicious advertisements (malvertisements) on websites or within free software can contain ransomware. Clicking on these ads may trigger the download and installation of ransomware on your system.
• Infected Downloads: Downloading software, files, or torrents from untrustworthy or unofficial sources can lead to ransomware infections. Always download content from reputable sources.
• Social Engineering: Cybercriminals may use social engineering techniques to trick you into executing ransomware. This can include posing as tech support, service providers, or even friends and family to convince you to run a malicious program.
• Remote Desktop Protocol (RDP) Attacks: Attackers may attempt to gain unauthorized access to your system through open or weakly secured RDP connections. Once inside, they can deploy ransomware.