What is Lostdata Ransomware?

Lostdata is the name of a new ransomware strain. The new ransomware variant does not seem to belong to any particular larger ransomware family.

Upon encryption, the ransomware will change file names to a gargantuan new string. The original file names and original extensions are completely destroyed in the process. An encrypted file will have a name that begins with the email used for contacting the ransomware operator - "email-lostdata1@qq.com". Following this is a string that seems to indicate the ransomware's version, then the victim ID string and finally a huge string of randomly generated characters. Finally, the ".cbf" extension is appended to the new file.

Once it finished encrypting the victim system, Lostdata changes the desktop wallpaper. There is no traditional ransom note contained in a file, all the information is contained in the wallpaper image, which reads:

"Attention, your data is encrypted, to restore Files, write mail lostdata1@qq.com"

There is no decryption tool available for the Lostdata ransomware and your best bet would be restoring lost files from an offline backup.