Loading story…
French authorities warned that a large unsolicited email campaign used the subject line "Nous avons reçu votre paiement." to lure recipients into downloading a fake invoice, leading to ransomware infections across Windows environments. The messages linked to malicious downloads that ultimately delivered nested ZIP archives and executables, after which the malware encrypted files on infected workstations and accessible network shares before demanding payment for decryption.
Analysis of the campaign tied the activity to PyLocky, a Python-based ransomware family that impersonated Locky in its ransom note but was technically unrelated to the original Locky malware. Researchers said the operation heavily targeted European victims, especially in France, and used signed executables, PyInstaller, and Inno Setup to hinder analysis; the malware encrypted numerous file types with 3DES, gathered host details through WMI, delayed execution on low-memory systems as an anti-sandbox measure, and sent victim information to a command-and-control server over HTTP.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos released a free decryption tool for PyLocky ransomware victims. Talos said the tool works only when the infected machine's initial command-and-control traffic was captured, because data from that exchange is required for file recovery.
On August 2, 2018, a spam run distributed PyLocky to French businesses using invoice-themed social engineering lures. One observed message used the French subject line "Nous avons reçu votre paiement" and directed users to a malicious download URL.
CERT-FR reported a new unsolicited email campaign in France beginning in late July 2018 that distributed ransomware identified as Locky Locker. The phishing emails used the subject line "Nous avons reçu votre paiement" and linked victims to a ZIP-in-ZIP archive containing an executable.
Trend Micro observed waves of spam email campaigns distributing the Python-based PyLocky ransomware in late July 2018 and throughout August 2018. The activity appeared concentrated in European countries, particularly France, and used invoice-themed lures.
CERT-FR issued an alert describing the ransomware spam campaign affecting Windows systems in France and warning that anti-spam gateway blocking rates were relatively low. The alert included malicious URLs tied to the campaign and recommended containment, blocking, mailbox cleanup, and system rebuild actions.
Trend Micro published an analysis explaining that PyLocky only impersonated Locky in its ransom note and was actually an unrelated Python-based ransomware family. The report detailed its packaging with PyInstaller and Inno Setup, anti-sandbox behavior, 3DES encryption, command-and-control communications, and associated indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourcecert.ssi.gouv.fr
Open sourceblog.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have been sending phishing emails that impersonate **Interpol** and other international law-enforcement bodies to trick recipients into installing ransomware. The messages, framed as notices from an alleged “Cybercrime Investigation Unit,” accuse targets of suspicious or fraudulent activity and pressure them to review supposed evidence. Reports indicate the campaign has targeted small businesses across **Europe, Asia, the Middle East, and North America**, using fear and urgency to drive victims to open attacker-controlled files. The emails direct recipients to a password-protected archive hosted on **Proton Drive**, where the lure file is presented as evidence but ultimately leads to an executable disguised as a video. Once launched, the malware encrypts systems and drops a ransom note instructing victims to contact the operators via **Tox** rather than pay a fixed amount, indicating case-by-case extortion. Researchers said the payload appears to be a **simple custom-built ransomware strain** that does not match known families and relies on hardcoded values instead of more advanced infrastructure.
Aug 11, 2026
Proofpoint reported a sharp escalation in **Locky ransomware** distribution by threat actors associated with major **Dridex** operations, including a campaign that sent **tens of millions of emails** and heavily targeted organizations in the **UK and France**. The activity relied on malicious email attachments such as **JavaScript files**, weaponized documents, and archive-based lures, showing that established banking malware operators had moved aggressively into ransomware delivery at scale. Researchers said the campaigns used a newly identified downloader, **RockLoader**, alongside layered evasion tactics including heavily obfuscated JavaScript, junk files, malformed `Content-Type` headers, **RAR archives**, and misleading or double file extensions. Proofpoint also observed RockLoader delivering multiple payloads beyond Locky, including **Dridex 220**, **Pony**, and **Kegotip**, indicating a flexible malware distribution platform that was rapidly changing code and delivery methods to bypass detection and improve infection rates.
Jun 29, 2026
Small businesses across the United States, Europe, Asia, and the Middle East have been targeted with phishing emails impersonating the **“Interpol Cybercrime Investigation Unit”** and claiming the recipient is tied to an investigation. The messages use fear-based social engineering to push victims to a Proton Drive link hosting a password-protected archive, which contains multiple nested archives and a custom ransomware payload disguised as a video file. Bitdefender said the campaign has hit organizations in food and agriculture, legal services, pharmaceuticals, media, technology, and finance. Once launched, the malware encrypts files on available drives and drops a ransom note directing victims to contact the attackers through **Tox** instead of a leak site or negotiation portal. Researchers found no evidence of data exfiltration and said the operation appears to be the work of a less sophisticated actor rather than an established ransomware group. Bitdefender also identified a major implementation flaw: the decryption routine and key are embedded in the payload, allowing victims to recover files without paying, while defenders were urged to isolate infected systems, scan endpoints, maintain backups, train employees, and enable visible Windows file extensions.
Jul 2, 2026