Lilmoon ransomware

Lilmoon is a Windows ransomware listed in the VoidCrypt family. Each encrypted file gets a victim ID, an attacker email address and the ending .lilmoon. The note, Dectryption-guide.txt, asks victims to email a test file along with a key file the malware leaves in C:/ProgramData. It encrypts files on Windows machines. No data theft or leak site is tied to it.

Sources: In-house research

File extensions: .lilmoon

Decryptor: Decryptor availability has not been recorded.