{"id":22612,"date":"2022-07-19T18:30:54","date_gmt":"2022-07-19T18:30:54","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=22612"},"modified":"2022-07-19T18:30:56","modified_gmt":"2022-07-19T18:30:56","slug":"lilith-ransomware","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/lilith-ransomware\/","title":{"rendered":"Lilith: The Latest Threat in Ransomware"},"content":{"rendered":"\n

Discovered by malware<\/a> hunter JAMESWT<\/a> on Twitter, Lilith is ransomware<\/a> designed to lock Windows machines. The malware exfiltrates data before encrypting the targeted devices to provide additional means of extortion.<\/p>\n\n\n\n

The ransom note contains the following ultimatum and instructions:<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Victims have three days to contact the threat actors on a hidden Onion website to pay the ransom. While Lilith does not introduce any innovative approach, according to Cyble, it clearly shows a trend in the current ransomware landscape.<\/p>\n\n\n\n

The hackers posted their first victim on a data leak site before removing the publication later. The victim was a large construction group based in South America, which suggests that the hackers are aiming high – and may also be sensitive to any potential backlash from countries or law enforcement.<\/p>\n\n\n\n

Cyble warned<\/a> companies about a new \u201cwave of ransomware campaigns\u201d involving groups like RedAlert, Lilith And 0mega, focusing on Lilith in depth.<\/p>\n\n\n\n

Also read: Best Ransomware Removal and Recovery Services<\/a><\/p>\n\n\n\n

How Lilith Ransomware Operates<\/strong><\/h2>\n\n\n\n

Lilith is written in C\/C++ and targets 64-bit Windows systems. The malware uses a custom \u201c.lilith\u201d extension to rename encrypted files.<\/p>\n\n\n\n

According to Cyble, \u201cThe ransomware searches for files to encrypt on the local system by enumerating the file directories […] It ignores the file extensions such as EXE, DLL, and SYS and excludes a list of directory and file names from the encryption process.\u201d<\/p>\n\n\n\n

Cyble adds that \u201cupon execution, Lilith ransomware initially searches for a list of hardcoded processes in the file and terminates its execution if any of them are running on the target\u2019s machine.\u201d<\/p>\n\n\n\n

That way, the ransomware increases its chances of success significantly. Besides, the files are encrypted using local Windows cryptographic APIs and random keys generated on the fly.<\/p>\n\n\n\n

The researchers found artifacts in the code base that point to the BABUK ransomware, as Lilith excludes \u201cecdh_pub_k.bin,\u201d the public key used by BABUK, which could be a link between the two campaigns.<\/p>\n\n\n\n

How to Protect Against Lilith Ransomware<\/strong><\/h2>\n\n\n\n

Threat actors are aware that security teams are increasingly ready to fight, succeeding sometimes even before the deadline (see How One Company Survived a Ransomware Attack Without Paying the Ransom<\/a>).<\/p>\n\n\n\n

This double-extortion model is here to stay. Classic but efficient measures to prevent ransomware attacks are strongly recommended, but the key might be a tested recovery strategy and a continuity<\/a> plan. Such an approach involves proper backups and documented procedures.<\/p>\n\n\n\n

See the<\/em> <\/em>Best Backup Solutions for Ransomware Protection<\/em><\/a><\/p>\n\n\n\n

In addition, don\u2019t forget to scan your backup files for infection, and as it\u2019s essential not to let Lilith spread around your network and devices, infected machines must be isolated<\/p>\n\n\n\n

Organizations should also leverage proper network segmentation<\/a>. While the investments might be significant, the cost of ransomware attacks is usually high, and Lilith seems to target big companies.<\/p>\n\n\n\n

One of the critical aspects of these attacks is obviously the ransom payment. Official recommendations by security agencies and governments will likely discourage<\/a> the victims from paying any ransom. The reason is simple: there\u2019s no guarantee you’ll get a working recovery key, regardless of what attackers might say.<\/p>\n\n\n\n

You might get more damage with so-called decryptors that actually install other malware, and the attack could also escalate to include additional payment demands.<\/p>\n\n\n\n

That’s not to blame companies that made that choice. The pressure might be overwhelming and the stakes too high to resist the temptation to pay the ransom. Being offline for an extended period of time can easily outweigh the ransom price.<\/p>\n\n\n\n

However, another reason why it is not recommended to pay the ransom is that it could be illegal.<\/p>\n\n\n\n

Companies should prepare for such bad events and ensure that paying the ransom won\u2019t be used against them in court, as authorities might view it as encouraging cybercriminals or cyber terrorism.<\/p>\n\n\n\n

Read next: How to Recover From a Ransomware Attack<\/a><\/p>\n\n\n

\n \n\n \n\n
\n \n <\/path>\n <\/svg>\n <\/div>\n \n
\n
\n

\n Get the Free Cybersecurity Newsletter <\/h3>\n \n \n

\n Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday <\/p>\n <\/div>\n\n

\n
\n \n Email Address\n <\/label>\n \n <\/div>\n\n
\n
\n \n \n By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time. <\/label>\n <\/div>\n <\/div>\n \n