From 2-spyware.com
Lyli ransomware – a virus that makes images, documents, databases unopenable, so the ransom demanding message scares people into paying. This threat comes from a Djvu virus family, so files that get encrypted cannot get recovered in most of the cases. The intruder manages to infect machine silently when the pirated software piece gets downloaded or from a malicious macro virus dropped as an email attachment.[1] That happens quickly, so users only spot the infection when those files get directly damaged and some functions disabled. Encrypted data can be differentiated from other files because .lyli extensions are placed at the end of the original name and appendix that indicates the file type.