Loading story…
Researchers reported that GPcode (also known as PGPCoder and GpCode) evolved into a more serious ransomware threat by using working RSA-1024 encryption that made large-scale brute-force recovery impractical. Reporting tied the operation to suspected Russian actors who used Yahoo email accounts, E-Gold and Liberty Reserve payment channels, and communications that appeared to originate from Chinese IP addresses. Analysts said the malware’s extortion model relied on victim-specific public keys and custom decryptors, making backups and file recovery more realistic response options than attempting to crack the encryption or paying the ransom.
Reverse-engineering of a later GPcode sample showed the malware loading an encrypted cfg resource, creating the ilold mutex, enumerating logical drives, and encrypting files with selected extensions before appending the .ENCODED suffix. The sample used Windows CryptoAPI functions including CryptEncrypt, dropped HOW TO DECRYPT FILES.txt on the desktop, changed the wallpaper with a bitmap resource, demanded $120 by wire transfer, and directed victims to contact datafinder@fastmail.fm. The malware also skipped some files, avoided encrypting files smaller than 11 bytes, destroyed crypto material after processing, and ran ntfs_system.bat to delete itself from the infected system.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The analyzed 2010 GpCode variant presented a ransom note claiming RSA-1024 encryption and instructed victims to contact datafinder@fastmail.fm. It demanded $120 via wire transfer using SWIFT/IBAN details.
A reverse-engineering analysis documented a GpCode ransomware sample that enumerated logical drives, encrypted files matching a hard-coded extension list, and renamed affected files with the .ENCODED suffix. The sample also dropped a ransom note and changed the victim's wallpaper.
Analysis in the ZDNet reference attributed GPcode activity to Russian actors running three campaigns, with ransom communications using Yahoo addresses and payments through Liberty Reserve and E-Gold accounts. The same reporting noted ransom emails tied to Chinese IP addresses and offers to decrypt one file as proof before payment.
The Stop GPcode initiative called on cryptographers, government bodies, scientific institutions, antivirus companies, and independent researchers to help crack GPcode public keys. It said breaking a 1024-bit RSA key would require roughly 15 million modern computers running for about a year.
A new GPcode ransomware variant was observed in the wild with a correctly implemented RSA 1024-bit encryption scheme, making brute-force decryption impractical. The article states Kaspersky Lab was the first to report this new version.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported the return of **GpCode-like ransomware**, reviving a file-encrypting extortion model associated with one of the early ransomware families. The malware locks victim data and demands payment for recovery, signaling that older criminal techniques continue to reappear in updated campaigns rather than disappearing from the threat landscape. The report indicates that defenders should expect renewed use of classic ransomware tradecraft built around encryption, user coercion, and operational disruption. The resurfacing of a **GpCode-like** strain highlights the continued risk posed by recycled malware concepts that can be adapted for modern environments, particularly where organizations lack resilient backups, endpoint protections, and rapid containment procedures.
Jul 12, 2026
FTcode ransomware targeted European organizations with phishing emails masquerading as company or court notifications and delivering oversized malicious archives intended to evade sandbox analysis. The infection chain used obfuscated **VBScript** droppers and attacker-controlled scripting to launch **PowerShell**, download additional payloads from `.top` domains, register victims with command-and-control infrastructure, and establish persistence through scheduled tasks before retrieving the ransomware payload. A later FTcode variant expanded beyond encryption by stealing credentials from **Chrome, Firefox, Thunderbird, Outlook, and Internet Explorer** and exfiltrating them to the attacker. The malware stored victim identifiers locally, repeatedly polled its C2 servers, and in some cases delayed ransomware deployment for hours or days after the initial compromise, showing a shift toward a more flexible intrusion workflow built around scripting activity consistent with **MITRE ATT&CK `T1064`**.
Aug 14, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026