LAZPARKING ransomware – a file-locking computer virus that is aimed at companies
LAZPARKING ransomware is a cryptovirus that encrypts all non-system files on a targeted computer (or a whole network) and then tries to extort money for a decryption tool. This particular file-locking parasite is aimed at companies, but that doesn't mean that everyday computer users are safe.
When the ransomware virus finds its way into a computer, it encrypts all personal (or company) files like documents, backups, pictures, archives, databases, and so on. During the encryption process, all files are appended with a .LAZPARKING-xxxxxxxxxx extension.
Like all ransomware, including Fair, Weui, or LANDSLIDE, after the encryption, .LAZPARKING virus generates a ransom demanding note. This note, titled !!LAZPARKING-MESSAGE.txt is placed in all contaminated folders. But unlike other ransomware, victims of this cryptovirus receive personalized ransom notes.
| name | LAZPARKING ransomware, .LAZPARKING file virus |
|---|---|
| type | Ransomware |
| Appended file extension | All non-system files receive a .LAZPARKING-(random characters) extension |
| Ransom note | !!LAZPARKING-MESSAGE.txt |
| Additional information | Before encryption, cybercriminals steal a lot of sensitive company data and treated to release it to the public if the ransom demands aren't met |
| Criminal contact details | Victims can reach hackers by two given emails – jorge.smith@mailfence.com and finbdodscokpd@privatemail.com |
| Malware removal | Instead of dealing with the criminals, victims should remove the infection with powerful anti-malware software and look for alternative data recovery options |
| System fix | Computer systems that suffer from cyberattacks have their system files and settings messed up, to revert any changes, use the FortectIntego tool after ransomware elimination |
The first part of the LAZPARKING ransomware ransom demanding note consists of warnings. Hackers state that the victim network was penetrated and that any forced system shutdowns or storage volume disconnections might lead to data being damaged thus unrecoverable.
Then the creators of LAZPARKING ransomware point out that they have stolen the following data of the company:
- Approximately 4,000 files on company employees
- Payroll files with personal information
- Four hundred thousand customer records, including their names, addresses, credit card info, etc.
- Marketing data
- Financial, accounting data
If victims of LAZPARKING ransomware will refuse to cooperate with the cybercriminals, they threaten to make this stolen data available to the general public. They promise to provide proof of their actions when the victims contact them by either one of two given emails – jorge.smith@mailfence.com and finbdodscokpd@privatemail.com.
In the last part of the LAZPARKING virus note, the criminals try to convince their victims to pay for the decryption tool by stating that they will explain how they hacked the network. Furthermore, they offer free decryption of two small files (not exceeding 1Mb). If the victims don't comply, the hackers are threatening that they will attack again.
As always, we advise against contacting the criminals and paying the ransom. There are other ways to restore data. The report indicates[1] that companies who didn't pay the ransom and focused on rebuilding and data recovery spent twice as less than those who complied with the extortion demands.
Victims should remove LAZPARKING ransomware from their infected devices with the help of professional anti-malware software like SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. These kinds of applications are a must these days because ransomware attacks and malware, in general, aren't going anywhere soon.
After LAZPARKING ransomware removal, the cyberattack victims should take care of their system wellbeing. Commonly malware corrupts and modifies system registry and other essential system files. That could lead to computers exhibiting abnormal behavior. To reverse it, consider using the FortectIntego system repair software.
Message from creators of the LAZPARKING virus to their victims:
Hello!
Your network is penetrated.Forced shutdown of devices can lead to the loss of all data. Do not forcibly disconnect storage volumes from hosts,
interrupt process and restart. Damaged information cannot be recovered.All data is properly protected against unauthorized access by steady encryption technology.
We have downloaded essential data of company:
HR files.
Personal data of employees. Like background checks,ssn,account#,signatures.
Files of ~4000 employees from folder Departmental Shares\CTOPS\Admin\Employee Document Folder (Scan)
Payroll files like tax reports with personal info.
SQL database dumps. For example, 400k records of customers with name,address,email,credit card data from LAZPARIS server.
Marketing data, for example email lists for MailChimp.
Financial, corp accounting data.
…In case if you refuse to cooperate with us, all essential data will be published at forums. Full details and proofs will be
provided in case of contacting us by following emails.jorge.smith@mailfence.com
finbdodscokpd@privatemail.com
It's just a business.
We can help you to quickly recover all your files.
We will explain what kind of vulnerability was used to hack your network.
If you will not cooperate with us, you will never know how your network was compromised. We guarantee this will happen again.
We can decrypt 2 small files (up to 1MB) for free. Send files by email.
Register new email account at secure mail service like mailfence, protonmail to be sure that outgoing email not blocked by spam filter.
Don't use gmail!.WARNING!
Don't report to police. They will suspend financial activity of company and negotiation process.
Dodging ransomware on the world wide web
From annoying adware to perilous trojan horses, the internet is crammed with different kinds all malware,[2] just sitting there in the dark and waiting for oblivious computer users to download it. Different malware is spread in different ways, but ransomware is mainly distributed with the help of spam emails and torrent sites.
Hackers sent out thousands of spam emails each day. These could look like legitimate emails from banks, shipping companies, healthcare institutions, etc. Please don't rush into opening any hyperlinks or attachments. Look through the email, and search for grammatical mistakes or any other irregularities. If the email looks suspicious just delete it and forget about it.
Torrent websites are one of the favorite places for cybercriminals to hide their creations. They name malware as something that would catch the eye of an everyday computer user and upload it. Then they wait for the soon-to-be victim to download, let's say, the latest pirated software or a new game crack. Please don't visit these sites because they are riddled with all kinds of malware.
Using anti-malware software for LAZPARKING ransomware removal
All malware, no matter if it's just annoying or severe, has to be eradicated immediately. The same rule applies to LAZPARKING virus – it must be deleted as soon as it's detected or at the first sight of a ransom demanding note.
To remove LAZPARKING ransomware, experts[3] suggest using time-proven antimalware software like SpyHunterCombo Cleaner and MalwarebytesMalwarebytes. These apps should be powerful enough to take care of all the dirty business, as manual ransomware removal is a lengthy and challenging process.
Malware, especially ransomware, changes the system registry and other core system settings to help it thrive. These alterations might slow down your device and exhibit all sorts of abnormal behavior. To restore your computer to a pre-contamination phase (i.e., prior to LAZPARKING ransomware attack), we recommend using the FortectIntego tool.
Was this guide helpful?
Be the first to comment