.locked ransomware encryption: a practical response and recovery guide

When ransomware appends the .locked suffix to documents and photographs, those files become unreadable and the operators usually leave a ransom note on the desktop or in affected folders. Variants such as the Stop/Djvu family use this pattern, so a file ending in .locked is almost always the result of deliberate encryption rather than a faulty program. Recognising the marker early is the first step toward containing the damage.

For Australian households and small businesses, the impact often lands hardest during end of financial year reporting, when BAS statements and client records sit locally on a single workstation. A single encrypted folder can disrupt tax preparation for a sole trader in Brisbane or pause invoicing for a tradesperson in Adelaide. Acting with a clear plan matters more than acting quickly, because some rushed steps permanently destroy recoverable data.

Recognising the .locked file pattern

Files renamed to report.locked, budget.xlsx.locked or photo-2024.jpg.locked share a consistent signature. The original extension is preserved but pushed behind the new suffix, and opening the file produces a "Windows cannot open this file" prompt or a garbled preview. A ransom note named _README.txt or HOW_TO_DECRYPT.txt appears in every folder that contained encrypted material.

Other signs include a changed desktop wallpaper, disabled Task Manager and unusually high disk activity after all programs are closed. On networks serving Melbourne offices, the same behaviour appears across mapped drives within minutes, suggesting the ransomware is enumerating SMB shares.

Isolate the device before doing anything else

Disconnect the infected machine from every network — Wi-Fi, Ethernet, Bluetooth and any VPN — to stop the encryption reaching shared folders on a NAS, a printer or a OneDrive sync folder. Pulling the network cable is faster than disabling the adapter in software, because some families re-enable connectivity through scheduled tasks.

Do not power the device off; leaving it running preserves volatile evidence such as running processes, open handles and encryption key material that may still sit in memory. Photograph the ransom note on the screen and back it up to a clean device before any further action.

Isolation step	Why it matters	Risk if skipped
Disconnect from network	Stops lateral encryption of shares and cloud sync	Other endpoints become infected
Disable cloud sync clients	Prevents overwriting good copies with encrypted ones	Cloud backups may be lost
Disable AD account	Blocks credential reuse against domain resources	Admin shares can be encrypted next
Photograph the ransom note	Provides hash and IOCs for later analysis	Investigators lose artefact details

Check for an available decryptor before paying

Before considering payment, search repositories such as the No More Ransom project, run by Europol and security vendors, for a free tool matching the exact strain. The latest security news sections on specialist sites publish updates when researchers release working keys. Submitting a sample to a tool built for the wrong strain can corrupt the remaining files.

If no free utility is available, weigh the value of the encrypted material against the cost and risk. The Australian Cyber Security Centre advises against paying ransoms because it funds further criminal activity and offers no guarantee of a working key. For significant incidents, IDCARE can advise on negotiation alternatives.

Restore from clean backups the right way

Backups help only when they exist, are recent and have not been touched by the ransomware. Verify that the backup target — a USB hard drive, a remote NAS in Adelaide, or a cloud snapshot — was offline or versioned at the time of infection. Services such as Backblaze, iDrive and Acronis keep point-in-time copies, provided the agent was not active on the infected host.

Restore files to a clean operating system rather than the compromised one, otherwise the recovered data gets encrypted again within minutes. For deeper guidance on cleaning a Windows host, follow the step-by-step Windows removal guides covering Safe Mode cleanup, or reach the team through the contact page for tailored support.

Report the incident through Australian channels

Reporting is not optional for larger organisations: the Notifiable Data Breaches scheme under the Office of the Australian Information Commissioner requires eligible businesses to inform the regulator when personal information is likely compromised. Individuals should report through the Australian Cyber Security Centre's ReportCyber portal, because the data feeds threat intelligence used to protect other Australians.

Local consumers can report ransomware demands to Scamwatch, run by the Australian Competition and Consumer Commission, which tracks emerging patterns such as fake ATO-themed lures timed around tax time. Banks including Commonwealth Bank, NAB and Westpac have fraud teams that can monitor accounts if payment credentials were stored on the infected machine.

Harden the system against the next .locked variant

Treat the device as compromised until proven otherwise. Rotate passwords saved in browsers or credential managers, enable multi-factor authentication on email and remote access, and review remote desktop exposure. Exposed RDP remains the most common entry point for Australian small businesses according to ACSC reports.

Keep the operating system, browser plugins and PDF readers updated automatically, disable macros in Office documents from outside the organisation, and maintain an immutable or offline backup following the 3-2-1 rule. Run a phishing simulation every six months, since malicious attachments remain the leading delivery mechanism for .locked families in Australian telemetry.

Habits that reduce the blast radius of future attacks

A small set of disciplined routines prevents most ransomware scenarios from becoming disasters for Australian households and small businesses. The list below covers the practices that consistently reduce the blast radius when a .locked strain does slip through defences.

• Store critical records on a separate drive or cloud account that is not permanently mapped on the workstation.
• Keep one backup destination physically disconnected after each scheduled job.
• Avoid opening ZIP or ISO attachments sent unexpectedly, even if they appear to come from a known sender.
• Verify unusual payment or invoice requests by calling the supplier on a known phone number.
• Apply the principle of least privilege to user accounts, removing local administrator rights where possible.
• Subscribe to vendor threat feeds and the ACSC alert service for early warnings about active campaigns.
• Document the recovery steps you take today so the same playbook works during the next incident.

These habits form the most reliable defence against .locked encryption campaigns observed in Australian environments.