Loading story…
Security researcher Kim Dvash disclosed GhostLock, a proof-of-concept tool that abuses the legitimate Windows CreateFileW API to deny access to files on local systems and SMB network shares without encrypting or deleting data. By opening files with dwShareMode set to 0, the tool obtains exclusive handles that cause other users and applications to receive STATUS_SHARING_VIOLATION errors while the handles remain open, effectively creating a file-level denial-of-service condition.
Reports say GhostLock can recursively lock large numbers of files on network shares, can be run by standard domain users without elevated privileges, and could be amplified from multiple compromised endpoints to increase disruption. Researchers warned the technique may evade many security products because it relies on legitimate file-open operations rather than ransomware-style writes or encryption, and said it could also be used as a diversion during intrusions while attackers pursue data theft or lateral movement; recommended detection focuses on unusually high per-session open-file counts and ShareAccess = 0 visibility at the file server layer, supported by published SIEM queries and an NDR detection rule.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Dvash published a GhostLock whitepaper with SIEM queries and an NDR detection rule to help defenders identify the behavior, emphasizing monitoring high per-session open-file counts with ShareAccess = 0 at the file server layer. The guidance noted that many security tools may miss the activity because it relies on legitimate file-open operations rather than encryption or mass file writes.
Security researcher Kim Dvash of Israel Aerospace Industries released GhostLock, a proof-of-concept tool that abuses the legitimate Windows CreateFileW API with dwShareMode set to 0 to deny access to local and SMB-shared files. The technique allows even standard domain users without elevated privileges to recursively lock many files and trigger STATUS_SHARING_VIOLATION errors for other users and applications.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **GhostLock** (`CVE-2026-43499`), a long-hidden Linux kernel local privilege-escalation flaw that has existed since 2011 and affects nearly all mainstream distributions. The bug resides in priority-inheritance futex and real-time mutex handling, where a race condition can trigger a use-after-free and dangling pointer, allowing a logged-in unprivileged user to gain **root** on unpatched systems. The vulnerability affected kernels from Linux `2.6.39` through version `7.1`, and researchers reported a weaponized exploit with high reliability. The exploit can also enable **container escape**, raising risk for multi-user, cloud, and containerized environments. Researchers said the attack can bypass KASLR, hijack kernel control flow through the `inet6_protos` table, and use the **DirtyMode** technique to complete privilege escalation; they also tied GhostLock to a broader **IonStack** chain in which a Firefox flaw (`CVE-2026-10702`) delivers code execution before GhostLock elevates privileges, including in a demonstrated Firefox-on-Android scenario. The flaw was patched upstream in April under commit `3bfdc63936dd`, but the initial fix introduced a separate crash bug (`CVE-2026-53166`), prompting defenders to deploy current kernel updates rather than early patched builds.
Aug 25, 2026
Researchers report that **LockBit has resumed operations** with a new **LockBit 5.0** strain that targets **Windows, Linux, and VMware ESXi** systems, extending the group’s established cross-platform ransomware model after the disruption caused by Operation Cronos. Analysis of a newly discovered sample found strong code continuity with **LockBit 4.0**, indicating the malware is an evolution of the original codebase rather than a copycat. The new version adds heavy obfuscation, anti-analysis, and anti-forensics capabilities, including in-memory payload loading through DLL reflection, ETW patching, security service termination, and event log clearing, while the ESXi variant is built to encrypt virtualized environments at scale. Separate reporting ties LockBit activity to real-world intrusions and common access vectors. SecurityScorecard assessed a claimed attack on a major **state-owned Southeast Asian bank** and found network and malware evidence consistent with credential theft, **SSH/RDP-based access**, and possible data exfiltration before and after the victim appeared on LockBit’s leak site, though some public claims could not be independently verified. Another SecurityScorecard investigation found attackers exploiting **PaperCut** flaws **`CVE-2023-27350`** and **`CVE-2023-27351`**, with **`CVE-2023-27350`** used to deliver LockBit in observed cases, underscoring how the group and its affiliates continue to pair opportunistic vulnerability exploitation with mature, multi-platform ransomware tooling.
Aug 21, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026