What is Locky Ransomware?

Locky is a type of malware that encrypts files on your computer, making them impossible to open unless you have the decryption key. This key is typically only accessible by the Locky Ransomware creators, who then demand a ransom from the victim for them to regain access to their files.

How does Locky spread?

Attackers typically spread it through phishing emails that contain attachments or links that, when clicked, will download and install the Locky Ransomware onto your computer. They can also spread this ransomware through malicious advertisements or by unknowingly visiting an infected website.

How does it work?

Once Locky is installed on your computer, it will scan your hard drive for certain types of files to encrypt. This ransomware typically targets important files, such as documents, spreadsheets, photos, and videos. Once Locky has encrypted your files, it will append the ".locky" extension to the end of each file name. For example, "MyPhoto.jpg" would become "MyPhoto.jpg.locky". Locky will then display a ransom note that instructions on how to pay the ransom and decrypt your files.

How much does it cost?

Locky Ransomware creators typically demand a ransom of between 0.5 and 2 Bitcoins. But, the price can vary depending on how quickly you contact them and pay the ransom. Attackers may also threaten to delete your encryption key if you don't pay the ransom within a certain time frame, typically 24-48 hours.

History

Locky was first discovered in February 2016 by MalwareHunterTeam. It quickly rose to become one of the most prevalent forms of ransomware, with over 25 million Locky Ransomware infections reported by June 2016. Locky has continually evolved since its inception, with new versions being released regularly.The biggest Locky Ransomware outbreak occurred in August 2016, when the ransomware was spread through a massive spam campaign that used the Necurs botnet to send out over 700,000 emails per hour. This spam campaign resulted in over 23 million Locky Ransomware infections in just two weeks.

How to avoid Locky Ransomware infections?

The best way to avoid it is to be aware of how it can spread. Be cautious of phishing emails, especially those that contain attachments or links from unknown senders. Do not click on any advertisements on websites that you are not familiar with. Keep your anti-virus software up-to-date and perform regular backups of your important files to an external hard drive or cloud storage service.

What should you do?

If attackers have infected you with Locky Ransomware, the first thing you should do is disconnect your computer from the internet to prevent the malware from encrypting any more files. Then, you can use a reputable anti-malware program to scan your computer and remove this ransomware. Even if you can remove Locky from your computer, however, your files will still be encrypted and you will need the decryption key to decrypt them. This key is only accessible by the Locky Ransomware creators, so you will need to pay the ransom to get it.We do not recommend paying the ransom, as there is no guarantee that you will receive the decryption key even if you do.Instead, you should focus on restoring your files from a backup. If you do not have a backup, you may be able to use file recovery software to recover some of your encrypted files.We built SalvageData data recovery software to help you.

Public decryption tool

Unfortunately, there is no public decryption tool available for Locky Ransomware at this time.

Contact a data recovery service

SalvageData Locky Ransomware data recovery experts can help you recover your files without paying the ransom.SalvageData is the only Locky Ransomware data recovery service with a 100% success rate. We have recovered over 1 million files from Locky Ransomware infections.We have a no data, no charge policy, which means that you will only pay us if we can successfully recover your Locky Ransomware encrypted files.To get started, please contact us and schedule a free consultation.