LyaS Ransomware

The LyaS Ransomware is a new version of the LockCrypt 2.0 Ransomware. File-locker Trojans of this family can encrypt your PC's files, such as documents or images, and keep them from opening in the associated programs. Because modern versions aren't decryptable freely, users may require undamaged backups for recovery, but always can use anti-malware services for uninstalling the LyaS Ransomware or interrupting its installation exploits.

The LockCrypt 2.0 Ransomware's Next Roll-Out

With symptoms of more than passing similarity to families of import like Scarab Ransomware, the Globe Ransomware, or the Crysis Ransomware, the LockCrypt 2.0 Ransomware is mistakable for a different file-locking Trojan easily. Such resemblances are, however, frequent within most Ransomware-as-a-Service families, which tend to follow equally efficient and streamlined means of collecting ransoms. The LyaS Ransomware shows that this underrepresented family is capable of competing in its black market industry, even in the last days of 2018.

The LyaS Ransomware's family, usually, involves Remote Desktop exploits and brute-force attacks for giving criminals remote access over a targeted server, such as a business network that's using outdated infrastructure or passwords. Once they gain system access, they drop and run a copy of the LyaS Ransomware, which includes a UI for remote usability. The most likely encryption method that the LyaS Ransomware would use for locking the server's media is a protected version of AES-256, although malware experts can't confirm it in this update.

Although most Ransomware-as-a-Service families, including the LyaS Ransomware's group, prefer Notepad TXT files for ransoming notes, the LyaS Ransomware supports using HTA Web pages. The ransoming process demands Bitcoins (with a lack of anti-fraud or other transaction protections accordingly) for the decryptor for unlocking the user's files. However, victims with no better resources may find the offer of a 'free sample' of decrypting up to three files more useful for recovering their data.

Hardening Your Media against the Attacks that Aim for It

The network-focused attacks of the LyaS Ransomware's family require attending to standard, but easily-overlookable security steps, for preventing. Brute-force hacking software is blockable by admins taking the time to change their passwords and login names into individualized and sophisticated strings while avoiding short, default, factory-standard or shared ones. Administrators also should doublecheck their port and firewall settings and, as always, update important software such as Samba.

Although the earliest versions of this family had some hope of free decryption solutions, modern versions like the LyaS Ransomware, the '.BDKR File Extension' Ransomware, and the '.BadNews File Extension' Ransomware aren't decryptable. Users protecting their media files by backing them up to other systems and storage drives can recover the data after disinfecting the PC, which may be the only, realistic recovery solution. However, most professional-grade anti-malware products should remove the LyaS Ransomware securely.

Since the ID credentials, extensions, and other details of the LyaS Ransomware's attacks are similar to those of a variety of RaaS Trojans, victims could be searching haphazardly for solutions for more than a short time. Malware experts only can encourage backing up one's work regularly for making the identity of a threat like the LyaS Ransomware into a moot point.