Loading story…
Researchers documented RegretLocker, a ransomware family that targets Windows systems and stands out for mounting Hyper-V virtual hard disks such as VHD and VHDX through the Windows Virtual Storage API, then encrypting the files inside those disks instead of encrypting the container files directly. Victim files are renamed with the .mouse extension, and the malware drops a ransom note named HOW TO RESTORE FILES.TXT. The approach can accelerate encryption and improve impact in virtualized environments, while the malware also attempts to encrypt ordinary files, large files, USB-attached storage, and SMB-accessible network shares.
Technical analysis found that RegretLocker uses AES for file encryption and retrieves an RSA public key from a Tor-based command-and-control server, with a hard-coded fallback key available when offline. It also deletes shadow copies and backups, disables recovery options, establishes persistence through the Windows Run registry key and a scheduled task, and uses the Windows Restart Manager API and taskkill to terminate processes or services that keep files open, while avoiding some remote-access and core system processes. Researchers said the code used to mount virtual disks appeared to draw on recently published security research, and they published hashes, network indicators, and a YARA rule to aid detection.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A reverse-engineering analysis said RegretLocker had been found in the wild in the month preceding 2020-11-17. The analysis documented its use of VHD mounting, Tor-based command and control, persistence, backup deletion, and encryption of local, removable, and SMB-accessible files.
Researchers reported that the RegretLocker ransomware family was discovered in October 2020. A sample was found by MalwareHunterTeam and later analyzed by Vitali Kremez and other researchers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **WastedLocker** was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as **SocGholish** and **Cobalt Strike**, then moved through victim environments with living-off-the-land utilities including **PsExec**, **PowerShell**, and **WMIC**. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations. Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through **NTFS alternate data streams**, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with **AES-CBC** using per-file keys protected by **RSA-4096**, then renamed files with victim-specific extensions such as `.garminwasted` or company-name variants ending in `wasted`, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Aug 15, 2026
RTM Locker has been identified as a private ransomware-as-a-service operation that uses affiliates under tightly controlled rules while expanding beyond Windows to target **VMware ESXi** environments with a dedicated Linux encryptor. Researchers said the group appears primarily financially motivated, communicates in both Russian and English, and avoids victims in CIS countries and some sensitive sectors to reduce publicity and law-enforcement attention. In ESXi intrusions, the malware targets virtual machines directly, appends the `.RTM` extension to encrypted files, and leaves ransom notes titled `!!! Warning !!!`, with attacks also linked to data theft for double extortion. Technical analysis of the Windows locker showed the malware repeatedly prompts for elevated privileges through UAC, kills selected processes and services, deletes shadow copies, clears event logs, encrypts files across mounted volumes using multithreaded IOCP-based routines, and then self-deletes. Reporting also tied the operation to a private affiliate model that may include former Conti-linked actors, while an internal dispute connected to the Russia-Ukraine war allegedly led to a server leak, reinforcing indications of Russia-linked membership and a geographically dispersed group.
Aug 15, 2026
Researchers reported that **ShrinkLocker** is a ransomware strain that turns Microsoft **BitLocker** against victims by modifying disk layouts, boot settings, and recovery mechanisms instead of relying only on conventional file encryption. Splunk said the malware checks the operating system, changes registry settings related to **RDP** and **TPM**, disables BitLocker key protectors, shrinks non-boot partitions, formats them, and rewrites boot configuration in ways that can leave affected machines difficult or impossible to recover. The malware was also observed exfiltrating data to command-and-control infrastructure and attempting to erase evidence by deleting logs, firewall rules, and scheduled tasks. Public reporting tied the activity to malware components including `disk.vbs_`, `Dim oShell.txt`, and `run.vbs`, highlighting a script-driven intrusion chain built around native Windows functionality. Bitdefender later published a **ShrinkLocker decryptor**, framing the threat as a case in which a legitimate Microsoft disk-encryption feature was repurposed for ransomware and then countered with a recovery tool. The combined reporting underscores that ShrinkLocker can both deny access to systems and complicate restoration by corrupting partitions and boot paths while using BitLocker as the locking mechanism.
Jun 29, 2026