Blue Locker

As a delivery channel, Blue Locker “can propagate across local networks and removable storage devices.”

“The group also exploits insecure remote access configurations...”

“The group also exploits insecure remote access configurations, drive-by downloads...”

“Reporting identify phishing emails with malicious attachments or links as the primary delivery mechanism.”

“Blue Locker” is commonly spread through targeted emails ... includes an attachment ... Once the victim opens the attachment ... [it] trigger[s] the malware’s execution.

The email ... includes an attachment or a malicious link. Once the victim ... clicks the malicious link, the malware uses social engineering techniques to convince the target to trigger the malware’s execution.

“Blue Locker” is distributed via a PowerShell-based loader that attempts to disable security defenses, escalate privileges, and load its ransomware payload.

“a victim downloads a trojan remote access tool to their computer, believing it to be another application and a safe download.”

“The group also exploits insecure remote access configurations...”

“Modifies system services for persistence and privilege escalation.”

The ransomware inserts itself into KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run. This registry key allows the ransomware to achieve persistence.

“Modifies system services for persistence and privilege escalation.”

The ransomware inserts itself into KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run. This registry key allows the ransomware to achieve persistence.

“Bypasses UAC via registry manipulation, elevating privileges without user consent.”

Blue Locker searches for a unique obfuscated string ... an XOR-encoded variant of “Chrome.exe.”

“Timestomping technique is used to alter file timestamps, making it difficult to detect during forensic analysis.”

“Implements obfuscation and deobfuscation to evade detection by security tools and analysts.”

It also uses ShellExecuteW to run wmic SHADOWCOPY DELETE to remove backup snapshots that could help restore files.

“Detects virtualized or sandboxed environments to avoid detection during dynamic analysis.”

“Uses raw input capture to steal user credentials or session data during active sessions.”

“Performs registry queries to gather system configuration and installed software information.”

Blue Locker locates the obfuscated Chrome.exe target process and “forcibly terminates it”; the report also states it “enumerates running processes.”

“Explores file and directory structures to find valuable files for encryption or exfiltration.”

“Discovers user accounts for credential harvesting or lateral movement across systems.”

“Detects virtualized or sandboxed environments to avoid detection during dynamic analysis.”

As a delivery channel, Blue Locker “can propagate across local networks and removable storage devices.”

“Uses raw input capture to steal user credentials or session data during active sessions.”

“Prepares collected data in temporary or known directories before exfiltration or further exploitation.”

Blue Locker “uses a combination of AES and RSA encryption algorithms to lock files” and appends “.Blue” to encrypted filenames.

“Stops system services to ensure the encryption process is not interrupted and maximizes the damage.”

It uses ShellExecuteW to run “wmic SHADOWCOPY DELETE” to remove backup snapshots; the table states it disables or deletes backups.

The PowerShell-based loader “attempts to disable security defenses”; the ATT&CK table also states: “Disables UAC to avoid detection and remain persistent.”