Loading story…
Security researchers linked WastedLocker to the Evil Corp threat group and reported that the ransomware was being used in targeted intrusions against large U.S. and enterprise victims. The operation followed a big-game hunting model in which attackers sought broad access across corporate networks before launching encryption, aiming to maximize business disruption and ransom pressure rather than relying on opportunistic mass infections.
Investigations found the attackers commonly gained initial access through fake Google Chrome updates delivered via compromised websites, then used post-compromise tooling including Cobalt Strike, Mimikatz, Empire, PowerSploit, PsExec, WMI, and living-off-the-land binaries such as msbuild.exe. The operators conducted manual reconnaissance, stole credentials from SAM and SYSTEM hives, executed remote PowerShell, abused administrative shares and service execution for lateral movement, cleared event logs, attempted to disable protections such as Windows Defender, Symantec Endpoint Protection, and Cisco AMP for Endpoints, and in some cases created local administrator accounts and captured screenshots before deploying the ransomware.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported a recent increase in WastedLocker activity and said the ransomware was primarily targeting U.S.-based organizations with substantial assets across sectors including legal services, utilities, manufacturing, retail, high tech, pharma, and transportation. The report also linked the activity to Evil Corp and described a SocGholish-to-Cobalt Strike intrusion chain used before ransomware deployment.
Cisco Talos published an analysis of the WastedLocker operator's post-compromise activity in corporate networks, including fake Chrome update delivery, Cobalt Strike use, credential dumping, lateral movement, defense evasion, persistence, and screenshot collection. The report characterized the operation as manual, operator-driven ransomware activity aimed at maximizing disruption and ransom pressure.
NCC Group published research describing WastedLocker as a new ransomware variant developed by the Evil Corp group, marking an early public identification of the malware family and its attribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourceblog.talosintelligence.com
Open sourceblog.fox-it.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourcesymantec-enterprise-blogs.security.com
Open sourceresearch.nccgroup.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **WastedLocker** was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as **SocGholish** and **Cobalt Strike**, then moved through victim environments with living-off-the-land utilities including **PsExec**, **PowerShell**, and **WMIC**. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations. Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through **NTFS alternate data streams**, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with **AES-CBC** using per-file keys protected by **RSA-4096**, then renamed files with victim-specific extensions such as `.garminwasted` or company-name variants ending in `wasted`, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Aug 15, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026
Sophos reported that the ransomware group **Warlock Group**, tracked as **GOLD SALEM**, has been compromising enterprise networks and deploying **Warlock ransomware** since March 2025, with 60 publicly named victims through mid-September across North America, Europe, and South America. The operation used a Tor-based leak site, activity on underground forums, and possibly relationships with initial access brokers to support intrusions and extortion. Observed attacks began with exploitation of the **SharePoint ToolShell** exploit chain, followed by deployment of an **ASPX web shell** and a Golang-based WebSockets backdoor for persistence. Sophos said the actors stole credentials with **Mimikatz**, moved laterally with **PsExec** and **Impacket**, deployed ransomware through **Group Policy Objects**, and disabled endpoint protection using a **bring-your-own-vulnerable-driver** technique involving a vulnerable **Baidu Antivirus** driver; investigators also observed abuse of **Velociraptor** to establish a **Visual Studio Code** network tunnel. Microsoft tracks the activity as **Storm-2603** and assesses it with moderate confidence as China-based, though Sophos said it could not independently confirm that attribution.
Jun 29, 2026