Lokas Ransomware

The Lokas Ransomware is a file-locking Trojan from the STOP Ransomware family. Like other Ransomware-as-a-Service threats, the distribution channels are variable, but its attacks always include blocking media files on your computer, changing their extensions, and creating ransom notes. Users should avoid any dangers from this threat by making safe backups and use a dedicated anti-malware program for removing the Lokas Ransomware from infected systems.

A Brief Stop on Fake Updates for the STOP Ransomware's Child

With campaigns utilizing hired versions of the STOP Ransomware as predominant as ever in the Ransomware-as-a-Service industry, many of their attacks show few differences besides their choices of extensions, addresses, and Trojan names. Now, the Lokas Ransomware is another addition to the business that's enabled the Besub Ransomware, the Kiratos Ransomware, the Rectot Ransomware, the Promos Ransomware, and dozens of others. Whether or not it makes full use of the features its family possesses, the Lokas Ransomware is another trap for Windows users' files to suffer mostly-irreparable damage.

The Lokas Ransomware attacks files by encrypting them with AES encryption that it can secure with an offline or online algorithm code. Only the former of the two choices gives victims a chance of recovering their work through general-purpose, freeware decryptors, and requires interrupting the Trojan's connection to its C&C server. Otherwise, all documents and other content with the 'lokas' extension is, effectively, at the mercy of the threat actor and his ransom demands.

These features are standardized to the STOP Ransomware family. Less consistent than the locking of data, however, is the periodic usage of fake Windows update prompts. Some members of this family, including the Lokas Ransomware, generate these pop-ups for distracting the user while the attack occurs. Naturally, there is no update progress – the GUI is a fake display for keeping victims from interfering until all of their content is 'safely' hostage.

Getting Your Data Restoration without Ransoming It

The free decryption utility for STOP Ransomware's family is fully compatible with many variants, as long as the offline-mode encryption is responsible for blocking the victim's files. In other cases, users can risk paying – and getting nothing in exchange – for the threat actor's assistance or restoring from their last, unaffected backup. Since the Shadow Volume Copies are at constant risk of deletion from most Trojans with file-locking properties, malware experts suggest depending on other backup strategies, such as USBs or cloud services.

Many areas at risk from the STOP Ransomware's campaigns are in Southeast Asia, such as the Philippines, Thailand or India. However, most Windows systems are vulnerable to these encryption attacks, and the Lokas Ransomware's family, unlike some, doesn't filter its victims according to variables like local language settings. Users should scan e-mail downloads and torrents, especially, for potential risks, and, hopefully, delete the Lokas Ransomware before the encryption happens.

The Lokas Ransomware may be faking being an invoice or workplace document coming in an e-mail, pretending that it's a game crack or other, equally-possible options. The best strategy for anyone with files worth keeping is making sure that they're safe, even if a Trojan from this family ekes its way onto their computer..