Loading story…
Proofpoint reported a sharp escalation in Locky ransomware distribution by threat actors associated with major Dridex operations, including a campaign that sent tens of millions of emails and heavily targeted organizations in the UK and France. The activity relied on malicious email attachments such as JavaScript files, weaponized documents, and archive-based lures, showing that established banking malware operators had moved aggressively into ransomware delivery at scale.
Researchers said the campaigns used a newly identified downloader, RockLoader, alongside layered evasion tactics including heavily obfuscated JavaScript, junk files, malformed Content-Type headers, RAR archives, and misleading or double file extensions. Proofpoint also observed RockLoader delivering multiple payloads beyond Locky, including Dridex 220, Pony, and Kegotip, indicating a flexible malware distribution platform that was rapidly changing code and delivery methods to bypass detection and improve infection rates.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Proofpoint described an April 7 Locky ransomware email campaign involving tens of millions of messages, primarily targeting organizations in the UK and France. The activity was part of the broader surge attributed to actors tied to Dridex operations.
Proofpoint identified a newly observed intermediary downloader called RockLoader being used in the campaigns. It was seen delivering Locky as well as other malware families including Dridex 220, Pony, and Kegotip.
Proofpoint reported a major increase in Locky ransomware email campaigns in early 2016, linking the activity to actors associated with large Dridex operations. The campaigns used JavaScript attachments, malicious documents, and multiple evasion techniques to improve delivery and bypass detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that threat actors associated with the **Dridex** banking trojan expanded into ransomware operations by distributing **Locky**, linking a major financial malware crew to one of the most disruptive file-encrypting threats at the time. The activity showed established cybercriminal operators reusing their spam delivery infrastructure and malware distribution expertise to push ransomware at scale. The report also identified a new malware component called **RockLoader**, which was introduced as part of the infection chain supporting Locky delivery. The combination of Dridex-linked distribution, high-volume malicious email campaigns, and an added loader stage indicated a more modular and professionalized attack workflow designed to improve payload delivery and broaden the operators' monetization options.
Jul 12, 2026
Threat researchers and incident responders linked **TA505** to a years-long progression from massive malspam operations delivering **Dridex**, **Locky**, **Jaff**, **GlobeImposter**, and other payloads to more targeted intrusions aimed at full-network compromise and ransomware deployment. Early campaigns relied heavily on the **Necurs** botnet and phishing lures with malicious PDFs, macro-enabled Word documents, ZIP archives, `.url` shortcuts, and `.iqy` files, while later operations introduced loaders and remote-access malware including **FlawedAmmyy**, **Marap**, **FlowerPippi**, and **Gelup**. Researchers reported that these tools supported host fingerprinting, encrypted command-and-control, persistence, privilege escalation, and delivery of follow-on payloads, showing a shift from simple malware distribution to modular access operations. The group’s later activity culminated in enterprise-wide attacks associated with **Clop** ransomware, including the compromise of **Maastricht University**, where attackers reportedly entered through phishing, escalated privileges on an unpatched system, mapped the network, harvested credentials, and encrypted **267 Windows servers**, leading the university to pay a **30 bitcoin** ransom. Separate reporting on 2020 **Dridex** campaigns showed continued use of macro-enabled documents, PowerShell downloaders, `rundll32.exe`, HTTPS command-and-control, and multiple persistence mechanisms, underscoring that TA505 maintained high-volume delivery tactics even as it adopted tools such as **Mimikatz**, **Cobalt Strike**, **WMIC**, **RDP**, **PowerSploit**, **PingCastle**, and **AdFind** to move laterally, disable defenses, and prepare domain-wide ransomware deployment and, in some cases, extortion through stolen data.
Aug 15, 2026
A surge in sophisticated cyberattacks has been observed, with threat actors employing a variety of tactics to compromise organizations and individuals. Notable incidents include the use of the BYOVD (Bring Your Own Vulnerable Driver) technique to deploy DeadLock ransomware, as well as targeted campaigns leveraging phishing emails with HR-related lures to distribute Remcos RAT malware. Additionally, attackers are exploiting popular movie torrents to spread Agent Tesla via layered PowerShell scripts, and Android users in Spain are being targeted by the DroidLock ransomware, which can hijack devices and demand ransom through full-screen overlays. These campaigns demonstrate a trend toward multi-stage infection chains, abuse of legitimate tools and drivers, and the use of social engineering to increase the likelihood of successful compromise. Other significant developments include the targeting of Canadian organizations by the STAC6565/Gold Blade group using QWCrypt ransomware, and the emergence of new threat actor tactics such as disabling endpoint detection and response (EDR) systems to facilitate ransomware deployment. The threat landscape is further complicated by the activities of groups like Scattered Lapsus$ Hunters, who use social engineering and typosquatted domains to compromise Zendesk users, and the exposure of internal dynamics within ransomware groups like BlackBasta, revealing operational stress and internal mistrust. These incidents underscore the evolving nature of cyber threats, the blending of espionage and financial motives, and the increasing sophistication of both technical and social attack vectors.
Jun 29, 2026