Lazarus Ransomware

The Lazarus Ransomware is a file-locking Trojan that can keep your media, such as documents, from opening as part of a ransoming ploy. The Lazarus Ransomware has aesthetic similarities to Petya Ransomware but is distinct from that threat in its code. Users should always save backups carefully for recovering from such attacks and use dedicated anti-malware software for evading infections or uninstalling the Lazarus Ransomware.

The Petya Ransomware Rises from Its Grave, Sort Of

The many years old Petya Ransomware is nigh-legendary among file-locker Trojans, as a spectacularly disruptive threat that doesn't take files hostage merely but blocks the Windows operating system. This notoriety is a source of copycats, including the unexpectedly new Lazarus Ransomware. This file-locking Trojan uses the looks of the Petya Ransomware for intimidation, but its payload is more similar to that of a modern version of such threats.

The Lazarus Ransomware is an estimated tool of the Lazarus Group currently, which conducts both espionage and for-profit campaigns involving hacking companies and government networks around the world. This threat actor includes numerous sub-divisions and can go so far as to falsify entire company identities and websites, as per the AppleJeus campaign of 2018. However, the Lazarus Ransomware's installation methods may use different exploits, such as brute-forcing logins, port-scanning for improperly-configured servers or an e-mail phishing tactic.

The Lazarus Ransomware is a native Windows program. It generates a visible CMD window with lines referencing its decryption key – possibly, giving users a chance to react if the Trojan isn't running under a remote attacker's supervision. It uses a conventional Registry entry for persistence, adds tags to filenames such as IDs, e-mails, and 'Snc' extensions, and, of course, encrypts files so that they will not open.

The Lazarus Ransomware's wallpaper change is its most whimsical feature due to mimicking the boot-up screen of the Petya Ransomware: a red background with an ASCII skull and crossbones.

Digging a Deeper Hole for Trojans of the Past

Unusually, the Lazarus Ransomware doesn't lock files on the user's desktop, even though this location is vulnerable to similar attacks by other Trojans exceptionally. However, other directories, such as the Windows user's document folders, could be at risk. Due to decryption being a commonly-impossible solution, malware researchers remain steadfast in advising all users to keep backups on other devices. Local ones are at risk for encryption or deletion in nearly every case.

Administrators should establish configuration settings that protect their servers from attacks abusing password-guessing strategies and black hat software with infiltration-oriented features. Users also might consider disabling JavaScript and Flash by default in their browsers and avoiding contact with e-mail attachments before determining their legitimacy. The Lazarus Ransomware is, so far, a Windows-only threat.

The Trojan has no unique entries in most threat databases currently. Still, despite this minor impediment, the usual anti-malware products can flag and remove the Lazarus Ransomware without letting it harm your files. The Lazarus Ransomware's only clue to its ransoming service is the e-mail address it hands out to victims. What the cost could be is questionable, but it's always a price that the well-protected PC user can spare themselves of paying.