Loading story…
GlobeImposter ransomware was distributed through malicious JavaScript downloaders delivered by spam campaigns and, in some cases, the Necurs botnet, with lures posing as shared photos and compressed archives masquerading as image files. Researchers reported samples such as IMG_8798.js downloading payloads from remote infrastructure and launching them with process-hollowing-like behavior, then establishing persistence in public user directories and via RunOnce registry entries. The malware family is a copycat of Globe ransomware, reusing similar ransom-note and file-renaming behavior while evolving into multiple variants, including one that appended ..726 and another that appended ..doc to encrypted files.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
In February 2023, AhnLab described a ransomware campaign affecting South Korean organizations and named the malware 'TZW' ransomware. SentinelOne later assessed TZW as a rebranded GlobeImposter variant based on overlapping code, ransom-note structure, TOR portals, and shared server infrastructure.
On December 26, 2017, the Necurs botnet delivered the GlobeImposter ..doc variant through spam messages containing ZIP archives with JavaScript downloaders. Analysis linked the malware to C2 IPs 137.254.120.31 and 74.220.219.67 and Tor decryption service URLs.
A GlobeImposter sample later tied to the ..doc variant was first seen in the wild, according to VirusTotal. This variant would go on to append ..doc to encrypted files and use Read___ME.html ransom notes.
A December 2017 malspam campaign distributed a GlobeImposter variant via photo-themed emails carrying 7z archives with obfuscated JavaScript downloaders. The ransomware appended ..doc to encrypted files, dropped Read___ME.html, and directed victims to a Tor payment site.
FortiGuard Labs reported JavaScript downloaders spreading a new GlobeImposter variant identified as version 726. The malware downloaded its payload, established persistence, deleted shadow copies, killed processes, encrypted files with the ..726 extension, and dropped RECOVER-FILES-726.html ransom notes.
Emsisoft published a free decryption tool page for GlobeImposter, describing the ransomware as a Globe copycat that appends the .crypt extension and drops HOW_OPEN_FILES.hta ransom notes. The page also explained that decryption requires an encrypted file and its original unencrypted counterpart.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourceacronis.com
Open sourcebleepingcomputer.com
Open sourceblog.fortinet.com
Open sourceemsisoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe threat actors using *document-themed lures* to deliver malicious payloads while evading user scrutiny and defensive controls. ASEC-reported activity shows **weaponized PDF files** distributed via phishing (e.g., “Invoice,” “Payment”) that display a decoy image or a “Failed to load PDF document” error to push victims to click through to **fake Google Drive/Adobe pages**, ultimately installing legitimate **RMM tools** (e.g., *Syncro, SuperOps, NinjaOne, ConnectWise ScreenConnect*) signed with a valid certificate to blend in as administrative software rather than obvious malware. Separately, research on **APT36 / Transparent Tribe** details a targeted espionage operation against Indian government, academic, and strategic entities using spear-phishing ZIP attachments containing **oversized LNK files masquerading as PDFs**; execution chains leverage `mshta.exe` to retrieve remote HTA content, decrypt and reconstruct payloads in memory, and deploy a RAT (tracked as **ReadWriteRAT**) with capabilities including encrypted C2, remote command execution, screenshot capture, clipboard access, and data theft. Other items in the set cover unrelated threats—WordPress SEO cloaking that selectively serves malicious content to verified Googlebot IP ranges, a vendor blog overview of **Medusa** ransomware activity, and reporting on **CrazyHunter** ransomware impacting Taiwan healthcare—indicating the commonality here is *document/SEO deception techniques*, not a single unified incident.
Jun 29, 2026
Researchers reported a large spam campaign distributing **Zepto** ransomware through ZIP archives containing malicious JavaScript files, often named with a `swift` theme. Cisco Talos observed **137,731 emails** and **3,305 unique JavaScript samples** over four days, with messages using executive-themed sender personas, customized salutations, and varied subject lines to lure recipients into opening the attachment. Once launched, the script used `wscript.exe` to contact hardcoded command-and-control domains over HTTP, download the payload, encrypt local files, append the **`.zepto`** extension, and present ransom demands through files including `_HELP_instructions.jpg` and `_HELP_instructions.html`, along with wallpaper changes. Technical analysis found Zepto was not a wholly new family but an evolved **Locky** variant with extensive code overlap. Researchers said the malware reused Locky decoding behavior, including the `321` argument, and retained largely identical encryption and file-targeting logic, while adding features such as an `RDTSC`-based anti-VM check. Bindiff analysis showed a **0.86 similarity coefficient**, with **99.9%** of Locky’s 821 functions matched in Zepto, reinforcing that the campaign represented a significant continuation of spam-delivered Locky-style ransomware activity rather than a separate threat lineage.
Aug 15, 2026
Researchers tied **Lyposit**, **Lucky Locker**, and **Bomba Locker** to a closely related lockscreen ransomware operation that used geographically tailored ransom pages, affiliate-style distribution, and command-and-control infrastructure to lock Windows systems. Analysis linked the malware families through shared panel behavior, similar country-specific screen designs, and overlapping technical traits, while reporting that the operation targeted victims in the United States and multiple European countries and was distributed through exploit-kit traffic including **ProPack**, **BH EK/q.php**, and **Darkleech**. Technical reviews showed a multi-stage infection chain involving a Visual Basic dropper, an intermediate loader, RC2-based decryption, and a final DLL payload that installed persistence and fetched HTML ransom content from remote servers using **BITS**, **WinINet**, and encrypted communications. The malware reportedly supported Safe Mode persistence, command processor modification, process injection, memory-only loading, antivirus evasion, and a **Windows Vista/7 UAC bypass**, while some ransom screens even mimicked a **Mac OS** interface despite infecting Windows hosts.
Aug 15, 2026