LIZARD ransomware, a malicious application, locks or encrypts all non-system files, such as photos, videos, documents, and others. Recently it is discovered that LIZARD ransomware belongs to the Phobos family. This ransomware encrypts files and appends the victim’s ID, the email address firstname.lastname@example.org, and the “.LIZARD” extension to filenames. The .LIZARD extension on files shows that they were infected by LIZARD ransomware attacks and file encryption. LIZARD also generates “info.hta” and “info.txt” files with ransom notes. This ransomware modifies filenames such as from ‘1.jpg’ to ‘1.jpg.id[9ECFA84E-3351].[email@example.com].LIZARD’.
The ransom note directs victims to send an email to firstname.lastname@example.org or a Telegram message to @Online7_365. The ransom note further states that the cost of data decryption is determined by how quickly the attackers are contacted.