Loading story…
Researchers analyzing LooCipher ransomware found that the malware encrypts files with a single AES-128 key in ECB mode, appends the .lcphr extension, and leaves the original files as 0-byte placeholders. Fortinet reported that brute-forcing the key was not practical, but recovery could be possible if defenders captured the malware’s C2 traffic or extracted the encoded key from the memory of a still-running LooCipher process. The analysis also showed the ransomware sends a victim ID, an encoded AES key, and the victim machine’s IP address to its command-and-control server, and that the key encoding could be reversed because it relied on a position-based obfuscation scheme.
Following that finding, ZLab / CERT-Yoroi published a beta decryption tool for LooCipher victims, citing an active infection campaign and crediting Fortinet’s work on the obfuscation flaw. The tool is designed to decrypt files without administrator privileges, but it only works if the infected system has not been restarted after compromise and requires the user to provide the ransomware process ID, underscoring that recovery depends on access to the still-running malware process rather than a universal offline decryptor.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
CERT-Yoroi / ZLab updated the repository README to document the beta LooCipher decryptor, including usage instructions and limitations. The README also credited Fortinet's analysis of an obfuscation flaw that supported part of the recovery approach.
The GitHub repository was updated with a Python source file, "decryptor.py," for the LooCipher decryption tool. The tool requires the victim to provide the ransomware process ID and does not require administrator privileges.
CERT-Yoroi / ZLab added the beta executable "ZLAB_LooCipher_Decryptor.exe" to its GitHub repository for helping LooCipher victims recover files. The repository states the tool was released quickly because of an ongoing LooCipher infection campaign and works only if the infected system has not been restarted.
FortiGuard Labs published an analysis of LooCipher ransomware's encryption routine, finding that the sample used a single AES-128 ECB key for all files and that recovery might be possible by decoding the key from captured C2 traffic or extracting it from process memory. The analysis also noted the malware appends the .lcphr extension and leaves original files as 0-byte files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Lorenz** ransomware operation emerged as an enterprise-focused threat using **double extortion**: attackers stole unencrypted data before encrypting systems, then pressured victims by publishing stolen files on a leak site and, in some cases, offering both the data and internal network access for sale. Reported ransom demands ranged from **$500,000 to $700,000**, with victims directed to a dedicated Tor payment portal featuring Bitcoin payment instructions and live chat. Researchers said the malware appears linked to earlier **ThunderCrypt** and **SZ40** ransomware, though it remained unclear whether the same operators were involved or whether code had been reused. Analysis of the malware showed it uses **AES** encryption with an embedded **RSA** key, appends the `.Lorenz.sz40` extension to encrypted files, and drops a ransom note named `HELP_SECURITY_EVENT.html`. A later breakthrough by Tesorion led to a **free decryptor** being added to the **NoMoreRansom** project, allowing recovery of some files without paying. The researchers found a flaw in Lorenz’s encryption routine that irreversibly destroys the last **48 bytes** of files whose size is a multiple of 48 bytes, meaning some data remains corrupted even if decrypted, while other file types such as Microsoft Office documents, PDFs, and some images and videos can be recovered in certain cases.
Aug 15, 2026
Researchers analyzed **Polyglot**, a ransomware family distributed through spam emails that directed victims to malicious `RAR` archives, and found it was designed to closely imitate **CTB-Locker**. The malware copied CTB-Locker’s interface, ransom workflow, Bitcoin payment model, and cryptographic presentation, while operating as an independently developed threat rather than a code-sharing variant. Once executed, Polyglot encrypted files without renaming them, established persistence through autostart entries and **Task Scheduler**, and communicated with a Tor-based command-and-control infrastructure via a public `tor2web` service. The investigation found critical implementation flaws in Polyglot’s random number generation and `ZIP` password derivation, allowing encrypted files to be recovered without paying the ransom. Based on those weaknesses, researchers said victims could restore data using Kaspersky Lab’s free **RannohDecryptor** utility, version `1.9.3.0`, turning what appeared to be a convincing CTB-Locker-style extortion campaign into a ransomware operation with an available public decryption path.
Aug 14, 2026
Researchers analyzed **HildaCrypt**, a Windows ransomware family written in C# that was distributed as a fake XAMPP installer named `xamp.exe` and obfuscated with **ConfuserEx**. Once launched, it created a GUID-named folder under `%AppData%\Roaming%`, ran a batch script, deleted shadow copies, and attempted to stop SQL, backup, and anti-malware services before encrypting files. The malware used **AES-256-CBC** for file encryption, appended the `.HCY!` extension, and stored the AES key and IV in each file after encrypting them with an embedded **RSA-2048** public key; it then dropped an HTML ransom note, `HILDACRYPTReadMe.html`, directing victims to contact the operator by email. A separate development reduced the threat to victims after the ransomware’s developer released HildaCrypt’s master private decryption keys. Researcher **GrujaRS** had initially classified a sample as a STOP ransomware variant, but the author later said it was a HildaCrypt variant, and **Michael Gillespie** confirmed the keys were valid and published a working decryptor. The developer claimed the malware was created for “fun” and educational purposes, said it had not been used against anyone, and indicated development was likely ending as they moved toward legitimate cybersecurity work.
Aug 15, 2026