Dirty App Removal: Lazarus Ransomware

Lazarus Ransomware is a particularly dangerous threat that encrypts files on your system, demanding a ransom payment in exchange for their decryption. If you’ve been affected, there are steps you can take to recover and avoid paying the cyber criminals behind this ransomware.

What is Lazarus Ransomware?

Lazarus ransomware, discovered by Alex Svirid, is derived from the King Ouroboros ransomware family. It locks files using strong encryption, preventing users from accessing them. Afterward, victims are coerced into paying a ransom for a decryption tool, but it’s important to know that even paying the ransom doesn’t guarantee file recovery.

Once infected, Lazarus ransomware changes the names of encrypted files by adding a unique string containing an email address, a victim ID, and the “.Lazarus” extension. Updated versions use a “.Lazarus+” extension. Additionally, Lazarus creates a ransom note in a text file called “Read-Me-Now.txt” and displays a pop-up window instructing victims on how to proceed.

The Ransom Note

The ransom note includes instructions on sending one encrypted file to the cybercriminals via email at mr.teslabrain(at)gmail.com for decryption. However, victims are warned that if they fail to contact the attackers within 48 hours or attempt to use third-party decryption tools, the ransom will double, and encrypted files might be permanently damaged.

The note reads:

Why You Shouldn’t Pay the Ransom

Paying the ransom doesn’t guarantee file recovery. Many victims who pay never receive the decryption tools. Moreover, supporting criminal activity encourages the spread of ransomware. Instead of risking further loss, there are safer ways to remove the ransomware and protect your system.

How Lazarus Ransomware Spreads

Lazarus ransomware, like most malware, is typically distributed through:

• Spam email campaigns: Cybercriminals attach malicious files disguised as important documents (such as PDFs or Microsoft Office files) to emails, tricking users into opening them.
• Trojans: Once a system is infected with a Trojan, it can download additional malicious software, including ransomware.
• Untrustworthy software sources: Using unverified download platforms, free file-hosting sites, or P2P networks often leads to downloading malware.
• Fake software updates: These appear to be legitimate updates but instead download malicious software.

Protecting Yourself from Future Infections

• Use official software sources: Download programs only from legitimate, trusted websites.
• Update your software regularly: Ensure your operating system and applications are up to date using built-in update tools.
• Be cautious with emails: Avoid opening email attachments from unknown or suspicious sources.
• Avoid software cracking tools: These tools are illegal and often come bundled with malware.
• Backup your data: Regularly back up your files to an external storage device or a secure cloud platform.

Safely Removing Lazarus Ransomware

If your system is already infected with Lazarus ransomware, it’s crucial to act quickly. Experts in computer security recommend using a trusted anti-malware tool, such as SpyHunter, to automatically and safely remove the ransomware from your computer.

Steps to Remove Lazarus Ransomware:

1. Download and install SpyHunter or another trusted anti-malware program.
2. Run a full system scan to detect and isolate the Lazarus ransomware and any related threats.
3. Follow the software’s instructions to safely remove the ransomware from your system.
4. Restore your files from a backup if possible. If you don’t have a backup, consult cybersecurity professionals for further advice.

Lazarus ransomware is a serious threat, but by taking preventative steps and using reliable anti-malware software, you can safeguard your data and restore your system without succumbing to the ransom demands. Remember to always stay vigilant, keep backups, and protect your system with up-to-date software.

By following these expert-recommended steps, you can remove Lazarus ransomware and better protect your computer from future attacks.