Loading story…
Researchers reported that LokiLocker is a relatively new ransomware-as-a-service family targeting Microsoft Windows systems through a small, vetted affiliate network, with activity observed across Eastern Europe, Asia, and English-speaking victims. The malware, first seen in the wild in 2021, encrypts files using AES with RSA-protected keys, demands payment by email, and is written in .NET with NETGuard and the KoiVM virtualization plugin to complicate reverse engineering. Early infections were linked in some cases to trojanized brute-checker tools, and no free decryptor was available.
BlackBerry researchers said the operation may be using false-flag indicators to obscure attribution, citing Iranian-linked clues such as affiliate usernames, cracking tools associated with the AccountCrack team, and an Iran exclusion list in code, while cautioning that the true origin remains unclear. LokiLocker is also notable for a configurable wiper function that can delete non-system files, overwrite the Master Boot Record (MBR), and force a Blue Screen of Death if victims refuse to pay, increasing the risk of destructive impact beyond conventional ransomware encryption.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
AhnLab ASEC reported LokiLocker being distributed in Korea and said the ransomware was highly similar to BlackBit, with unpacked BlackBit samples indicating BlackBit was derived from LokiLocker. The report also published additional technical details on LokiLocker behavior and detection signatures.
BlackBerry reported that the LokiLocker ransomware family was first seen in the wild in mid-August 2021. Researchers described it as a Windows-targeting ransomware-as-a-service operation.
BlackBerry said LokiLocker contained Iranian-linked artifacts, including affiliate usernames seen on Iranian hacking channels, AccountCrack-associated tooling, and an Iran exclusion list in code. The researchers cautioned that these indicators could be false flags and that the malware's true origin remained unclear.
BlackBerry researchers reported that LokiLocker operated through a small vetted affiliate network of about 30 affiliates and included a configurable wiper that could delete non-system files if victims did not pay. They also noted anti-analysis protections such as NETGuard and KoiVM and said no free decryptor was available.
Researchers said early LokiLocker samples were distributed inside trojanized brute-checker hacking tools, including tools tied to the Iranian cracking team AccountCrack. BlackBerry suggested this may have reflected a beta-testing phase before broader affiliate use.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
blogs.blackberry.com
Open sourceasec.ahnlab.com
Open sourcemsspalert.com
Open sourcetheregister.com
Open sourceus-cert.cisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied **Lyposit**, **Lucky Locker**, and **Bomba Locker** to a closely related lockscreen ransomware operation that used geographically tailored ransom pages, affiliate-style distribution, and command-and-control infrastructure to lock Windows systems. Analysis linked the malware families through shared panel behavior, similar country-specific screen designs, and overlapping technical traits, while reporting that the operation targeted victims in the United States and multiple European countries and was distributed through exploit-kit traffic including **ProPack**, **BH EK/q.php**, and **Darkleech**. Technical reviews showed a multi-stage infection chain involving a Visual Basic dropper, an intermediate loader, RC2-based decryption, and a final DLL payload that installed persistence and fetched HTML ransom content from remote servers using **BITS**, **WinINet**, and encrypted communications. The malware reportedly supported Safe Mode persistence, command processor modification, process injection, memory-only loading, antivirus evasion, and a **Windows Vista/7 UAC bypass**, while some ransom screens even mimicked a **Mac OS** interface despite infecting Windows hosts.
Aug 15, 2026
Researchers detailed how **WastedLocker** was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as **SocGholish** and **Cobalt Strike**, then moved through victim environments with living-off-the-land utilities including **PsExec**, **PowerShell**, and **WMIC**. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations. Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through **NTFS alternate data streams**, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with **AES-CBC** using per-file keys protected by **RSA-4096**, then renamed files with victim-specific extensions such as `.garminwasted` or company-name variants ending in `wasted`, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Aug 15, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026