{"id":58064,"date":"2017-10-05T12:46:49","date_gmt":"2017-10-05T17:46:49","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=58064"},"modified":"2017-10-05T12:46:49","modified_gmt":"2017-10-05T17:46:49","slug":"locky-ransomware-ykcol","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/","title":{"rendered":"Locky Ransomware Returns as Ykcol"},"content":{"rendered":"

Locky Encrypts Files Leaving a .Ykcol Extension<\/h3>\n

A new Locky variant has been released into the wild and upon initial review it led researchers to a believe it was a new strain entirely, called Ykcol.\u00a0 However, after additional review, experts have confirmed Ykcol is another version of Locky.<\/p>\n

The email subject line has been confirmed as Status of Invoice.\u00a0 According to Bleeping Computer<\/a>, within the email there is an 7zip or 7z attachment.<\/p>\n

\"\"<\/p>\n

Photo – Bleeping Computer<\/p>\n

It is clicking on this attachment that will lead to infection.\u00a0 Therefore, once the attachment has been clicked on, the ransomware goes to work encrypting files.\u00a0 After encryption, it will change the file extension to .ykcol — which is Locky, spelled backwards.\u00a0 \u00a0The ransom demand is .4 bitcoins, which as of today’s value is equivalent to $1,693.28 USD.<\/p>\n

At this time, there is no way to decrypt the infected files for free, leaving only backups as a viable option to recover from this infection.<\/p>\n

Prevention is Key<\/h3>\n

Instead of relying on backups, or the sheer belief of “this won’t happen to me”, PC users are encouraged to do the following:<\/p>\n

    \n
  1. Keep your operating system updated<\/li>\n
  2. Ensure all of your programs are updated<\/li>\n
  3. Implement a security solution that implements application whitelisting<\/li>\n
  4. Partake in cyber security training to stay updated on the latest cyber security threats<\/li>\n
  5. Think before you click — Do you know the sender?\u00a0 Are you expecting this email?\u00a0 Never click on something, unless you’re absolutely certain it is legitimate<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    Locky Encrypts Files Leaving a .Ykcol Extension A new Locky variant has been released into the wild and upon initial review it led researchers to a believe it was a new strain entirely, called Ykcol.\u00a0 However, after additional review, experts have confirmed Ykcol is another version of Locky. The email subject line has been confirmed […]<\/p>\n","protected":false},"author":54,"featured_media":55338,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4949,4944,5000,5090],"tags":[4900,4363,5371],"class_list":["post-58064","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ransomware","category-ransomware-reports","category-ransomwarewar","category-slider","tag-locky","tag-ransomware","tag-ykcol"],"yoast_head":"\nLocky Ransomware Returns as Ykcol<\/title>\n<meta name=\"description\" content=\"This time Locky returned, but it attempted to disguise itself to avoid being associated with Locky, by changing file extensions to .ykcol...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Locky Ransomware Returns as Ykcol\" \/>\n<meta property=\"og:description\" content=\"This time Locky returned, but it attempted to disguise itself to avoid being associated with Locky, by changing file extensions to .ykcol...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/\" \/>\n<meta property=\"og:site_name\" content=\"PC Matic Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/pcmatic\" \/>\n<meta property=\"article:published_time\" content=\"2017-10-05T17:46:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/skullKeyboard-slider.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"550\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Kayla Elliott\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@pcmatic\" \/>\n<meta name=\"twitter:site\" content=\"@pcmatic\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kayla Elliott\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/\"},\"author\":{\"name\":\"Kayla Elliott\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/person\\\/d4a11f480158af9f8090d8d90e0de8db\"},\"headline\":\"Locky Ransomware Returns as Ykcol\",\"datePublished\":\"2017-10-05T17:46:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/\"},\"wordCount\":253,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/skullKeyboard-slider.jpg\",\"keywords\":[\"Locky\",\"ransomware\",\"Ykcol\"],\"articleSection\":[\"Ransomware\",\"Ransomware Reports\",\"RansomwareWar\",\"TechTalk Slider\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/\",\"name\":\"Locky Ransomware Returns as Ykcol\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/skullKeyboard-slider.jpg\",\"datePublished\":\"2017-10-05T17:46:49+00:00\",\"description\":\"This time Locky returned, but it attempted to disguise itself to avoid being associated with Locky, by changing file extensions to .ykcol...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/skullKeyboard-slider.jpg\",\"contentUrl\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/skullKeyboard-slider.jpg\",\"width\":1920,\"height\":550},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/locky-ransomware-ykcol\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Locky Ransomware Returns as Ykcol\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/\",\"name\":\"PC Matic Blog\",\"description\":\"Tech Tips and Tricks\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#organization\",\"name\":\"PC Matic - Top Antivirus Company in the USA.\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/techtalk.pcmatic.com\\\/wp-content\\\/uploads\\\/PC-MaticLogo-e1472689639222.png\",\"contentUrl\":\"https:\\\/\\\/techtalk.pcmatic.com\\\/wp-content\\\/uploads\\\/PC-MaticLogo-e1472689639222.png\",\"width\":1535,\"height\":483,\"caption\":\"PC Matic - Top Antivirus Company in the USA.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/pcmatic\",\"https:\\\/\\\/x.com\\\/pcmatic\",\"https:\\\/\\\/www.instagram.com\\\/pcmaticusa\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/pcmatic\",\"https:\\\/\\\/www.youtube.com\\\/c\\\/PCMaticVideo\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/person\\\/d4a11f480158af9f8090d8d90e0de8db\",\"name\":\"Kayla Elliott\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/author\\\/kayla\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Locky Ransomware Returns as Ykcol","description":"This time Locky returned, but it attempted to disguise itself to avoid being associated with Locky, by changing file extensions to .ykcol...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/","og_locale":"en_US","og_type":"article","og_title":"Locky Ransomware Returns as Ykcol","og_description":"This time Locky returned, but it attempted to disguise itself to avoid being associated with Locky, by changing file extensions to .ykcol...","og_url":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/","og_site_name":"PC Matic Blog","article_publisher":"https:\/\/www.facebook.com\/pcmatic","article_published_time":"2017-10-05T17:46:49+00:00","og_image":[{"width":1920,"height":550,"url":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/skullKeyboard-slider.jpg","type":"image\/jpeg"}],"author":"Kayla Elliott","twitter_card":"summary_large_image","twitter_creator":"@pcmatic","twitter_site":"@pcmatic","twitter_misc":{"Written by":"Kayla Elliott","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#article","isPartOf":{"@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/"},"author":{"name":"Kayla Elliott","@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/person\/d4a11f480158af9f8090d8d90e0de8db"},"headline":"Locky Ransomware Returns as Ykcol","datePublished":"2017-10-05T17:46:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/"},"wordCount":253,"commentCount":0,"publisher":{"@id":"https:\/\/www.pcmatic.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/skullKeyboard-slider.jpg","keywords":["Locky","ransomware","Ykcol"],"articleSection":["Ransomware","Ransomware Reports","RansomwareWar","TechTalk Slider"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/","url":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/","name":"Locky Ransomware Returns as Ykcol","isPartOf":{"@id":"https:\/\/www.pcmatic.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#primaryimage"},"image":{"@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/skullKeyboard-slider.jpg","datePublished":"2017-10-05T17:46:49+00:00","description":"This time Locky returned, but it attempted to disguise itself to avoid being associated with Locky, by changing file extensions to .ykcol...","breadcrumb":{"@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#primaryimage","url":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/skullKeyboard-slider.jpg","contentUrl":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/skullKeyboard-slider.jpg","width":1920,"height":550},{"@type":"BreadcrumbList","@id":"https:\/\/www.pcmatic.com\/blog\/locky-ransomware-ykcol\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pcmatic.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Locky Ransomware Returns as Ykcol"}]},{"@type":"WebSite","@id":"https:\/\/www.pcmatic.com\/blog\/#website","url":"https:\/\/www.pcmatic.com\/blog\/","name":"PC Matic Blog","description":"Tech Tips and Tricks","publisher":{"@id":"https:\/\/www.pcmatic.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pcmatic.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pcmatic.com\/blog\/#organization","name":"PC Matic - Top Antivirus Company in the USA.","url":"https:\/\/www.pcmatic.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/techtalk.pcmatic.com\/wp-content\/uploads\/PC-MaticLogo-e1472689639222.png","contentUrl":"https:\/\/techtalk.pcmatic.com\/wp-content\/uploads\/PC-MaticLogo-e1472689639222.png","width":1535,"height":483,"caption":"PC Matic - Top Antivirus Company in the USA."},"image":{"@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/pcmatic","https:\/\/x.com\/pcmatic","https:\/\/www.instagram.com\/pcmaticusa\/","https:\/\/www.linkedin.com\/company\/pcmatic","https:\/\/www.youtube.com\/c\/PCMaticVideo"]},{"@type":"Person","@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/person\/d4a11f480158af9f8090d8d90e0de8db","name":"Kayla Elliott","url":"https:\/\/www.pcmatic.com\/blog\/author\/kayla\/"}]}},"_links":{"self":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/posts\/58064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/users\/54"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/comments?post=58064"}],"version-history":[{"count":0,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/posts\/58064\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/media\/55338"}],"wp:attachment":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/media?parent=58064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/categories?post=58064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/tags?post=58064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}