Lapsus$ Group ransomware

This malicious ransomware functions by encrypting files and subsequently extorting victims for decryption payment. Upon initiating the execution of this malware on our test system, we observed that it appends a ".locked" extension to the filenames of the encrypted files. For instance, an original file named "1.jpg" would appear as "1.jpg.locked," "2.png" as "2.png.locked," and so forth. Once the encryption process concludes, a ransom demand message is displayed in a pop-up window. The note was written in French and contained allegations of data theft (a double extortion tactic). It's important to emphasize that this particular ransomware is not associated with the Lapsus$ cybercriminal group. It is likely that the ransomware developers are using their name either for increased notoriety or to give the impression of a sophisticated, high-level attack.

File extensions: .EzByZZART3XX, .locked

Ransom note filenames: Open.txt

Decryptor: Decryptor availability has not been recorded.