From csirt.cy
A relatively new ransomware named Lilocked by researchers and Lilu by the developers is actively targeting servers and encrypting the data located on them. All of the known infected servers are web sites, which is causing the encrypted files to show up in Google search results.
We first reported about Lilu in our The Week in Ransomware article on July 26th, 2019 when Michael Gillespie saw a sample uploaded to his ID Ransomware service. It was spotted again yesterday by security researcher Benkow who tweeted about it.
Google reports over 6,000 search results with web servers that have been encrypted by this ransomware and having their files renamed with a .lilocked extension. It should be noted that many of these results are for the same web sites.