A file with a litar extension has been encrypted by the Litar virus, which is a variant of STOP ransomware utilized by cybercriminals. It contains a file, such as a .PDF, .WMV, .MP3, or .BAK file, that has been renamed and encrypted by the virus. LITAR files became prevalent in June 2019.

The purpose of the Litar virus is to take a user's files hostage then force the user to pay the cybercriminals (by way of bitcoin) to unlock his files. The virus is primarily spread via phishing spam emails designed to coax the victim into opening a malicious email attachment. It may also be spread via fake PayPal links, Google Drive links to corrupt emails, or counterfeit social media buttons Once the virus affects a user's computer it begins scrambling his files, renaming them, and encrypting them. It appends the .litar extension onto the file extension. For example, a user's example.docx file becomes example.docx.litar. The virus then generates a .TXT ransom note names _readme.txt informing the user of the takeover and what he needs to do to recover his files. NOTE: There is no program currently available to effectively restore LITAR files. If a user backed up his files he can execute a full system restore.