L16 Ransomware
The L16 Ransomware is a potent threat that can lock users out of their own data. The L16 Ransomware, classified as part of the Medusa Locker family, initiates an encryption process on each compromised system that affects a large array of widely used filetypes - docs, PDFs, databases, archives, images, photos and more. The affected users will then be blackmailed by the hackers to pay a ransom in exchange for a decryption key and tool.
Whenever the L16 Ransomware locks a file, it appends '.L16' to that file's original name as a new extension. Afterward, the threat will deliver its ransom note by creating an HTML file on the infected system's Desktop. The name of the note-bearing file is 'HOW_TO_RECOVER_DATA.html.'
L16 Ransomware's Demands
According to the note, the threat uses a combination of the AES and RSA cryptographic algorithms to encrypt the victim's files. However, the L16 Ransomware also has allowed its operators to collect sensitive information from the breached systems and upload it to a private server. The hackers promise to delete the data after they get paid. Otherwise, their demands are not met, the data will either be released to the public for free or sold to interested third parties.
To learn the exact price and the specific payment details, users are instructed to visit a dedicated website hosted on the Tor network and accessible only via the Tor browser. As backup communication channels, the cybercriminals also mention two email addresses - 'ithelp02@decorous.cyou' and 'ithelp02@wholeness.business.' Victims of the L16 Ransomware are allowed to send up to three files to be decrypted for free. However, the files shouldn't contain any important information.
The full text of the ransom note delivered by the L16 Ransomware is:
'YOUR PERSONAL ID:
/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\
All your important files have been encrypted!
Your files are safe! Only modified. (RSA+AES)
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE
WILL PERMANENTLY CORRUPT IT.
DO NOT MODIFY ENCRYPTED FILES.
DO NOT RENAME ENCRYPTED FILES.
No software available on internet can help you. We are the only ones able to
solve your problem.
We gathered highly confidential/personal data. These data are currently stored on
a private server. This server will be immediately destroyed after your payment.
If you decide to not pay, we will release your data to public or re-seller.
So you can expect your data to be publicly available in the near future..
We only seek money and our goal is not to damage your reputation or prevent
your business from running.
You will can send us 2-3 non-important files and we will decrypt it for free
to prove we are able to give your files back.
Contact us for price and get decryption software.
qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
Note that this server is available via Tor browser only
Follow the instructions to open the link:
- Type the addres "hxxps://www.torproject.org" in your Internet browser. It opens the Tor site.
- Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.
- Now you have Tor browser. In the Tor Browser open qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion
- Start a chat and follow the further instructions.
If you can not use the above link, use the email:
ithelp02@decorous.cyou
ithelp02@wholeness.business
To contact us, create a new free email account on the site: protonmail.com
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.'
