Urausy

Urausy is a Windows ransomware family from the early police-locker era that displayed coercive lock screens and was part of the broader evolution from Reveton-style lockers into later families such as Uremtoo and Nymaim-linked variants. It has been associated with country-tailored locker pages and with related operations including Lyposit and other successor or variant strains. Reporting also links Urausy-derived design elements to later locker campaigns, indicating code or operational lineage within the same criminal ecosystem.

Urausy was distributed through exploit-kit-driven traffic and botnet tasking. Observed delivery chains included malvertising redirects into exploit kit infrastructure, as well as secondary payload deployment onto already infected systems. These campaigns relied on the specialized ransomware distribution economy of the period, including traffers, traffic direction systems, redirectors, and exploit kits to route victims by geography and browser profile before malware delivery.

As ransomware, Urausy’s primary function was to deny normal system use and extort payment from victims. High-confidence reporting supports its use in mass consumer-focused campaigns rather than narrowly targeted intrusions. The malware targeted Windows systems and formed part of a cluster of financially motivated locker malware that imposed significant disruption and monetary loss on victims.