FairWare ransomware attacks Linux, deletes user server files, demands 2 BTC ransom from users

If you run a web server running on Linux, and you haven't updated your system yet, we have something exciting for you. A ransomware called FairWare is on the horizon, and as you'll soon see, the name of this ransomware is ironic, it is anything but 'Fair'.

There are reports of users encountering this nasty malware, but it seems unclear how the infection occurred. It's also unclear if this is some kind of automated attack - one that scans the internet en masse to find places to infect - or if the attack is targeted. Whatever the case, if you've encountered this ransomware, it's not a good day for you.

Once infected, you will find that you cannot operate the website. Your web folders on the server will be deleted, and there will be a readme file referring you to a PasteBin file that will explain what is happening. The requirement is that users need to send 2BTC (about $1,150) to a specified Bitcoin address, or the file will be at risk of being leaked to the Internet.

In the past, this threat would have caused some annoyance, but it would have rarely succeeded. Unfortunately, this attack is bound to affect those who don't have the best backup plans. If good backups are in place, this means that this ransomware will have little impact on the server owner: they can install a new operating system, restore from backup and monitor the situation. This is much better than handing $1,150 to thieves (who may not actually have your data).

If FairWare continues to affect more servers, we will definitely learn how it infected the servers and how to fix it. However, this incident once again reminds us that we should pay attention to backups. If you don't know how to set up a good, reliable backup plan, you'd better Google it or ask someone who knows. You can't put yourself in a risky situation where you need to pay a ransom for your data.

In addition, this is also a good reminder to keep our servers updated. The longer you don't update, the higher the chance that your server will be hacked.