JapanLocker, also called SHC or SHCLocker, is ransomware for web sites seen in October 2016. It encrypts site files without adding an extension and moves them into folders named #LOCK#. The site index page is replaced with a notice reading "This Site Has Been Locked!" that tells the owner to write to japanlocker[@]hotmail.com. Attackers got in through hijacked remote desktop logins and content management plugins with hidden backdoors. It is tied to an Indonesian defacement group that also publishes open-source ransomware projects. Nothing in the notice mentions copied data and no leak site exists.
Sources: In-house research
Decryptor: Decryptor availability has not been recorded.
Data exfiltration risk: Undocumented — The JapanLocker page asks the site owner to make email contact to unlock the site and makes no claim of copied data. No theft or leak site is tied to this strain.
Systems typically targeted: Web sites. It encrypts site content and replaces the index page, after access through hijacked remote desktop logins or backdoored content management plugins.
Do this first: Change every hosting, remote desktop and CMS administrator password, and remove any plugins that were not deliberately installed. Restore the site from a backup made before the attack. Keep an encrypted copy, since a decryptor for SHC version 1 has been reported.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161