Server infected with Randsom incfection and all extensions are changed

[asulu]

Our server is infected with random virus and all files are changed with .idXXXX_locked extention.

Sample of files you can find in below link Malware - Google Drive

Your help much appreciated, also please let me know how server could have effected. In the first placed we formatted the server and got re infected.

 

[TwinHeadedEagle]

Hello,

Unfortunately this is a new ransomware infection and there is no much information about it. Read the links below that can help you understand how it remotely spreads. I cannot help you anymore with this infection.

RDP Bruteforce attacks on the rise
Ransomware using Remote Desktop to spread itself
Ransomware spreads through weak remote desktop credentials
Brute force RDP attacks depend on your mistakes
Ransomware and RDP – Are you vulnerable?

 

[asulu]

Are you sure is it through RDP connection?

 

[TwinHeadedEagle]

I told you I don't know anything about it. I just tried to help with some links I found here.