Loading story…
Researchers detailed how WastedLocker was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as SocGholish and Cobalt Strike, then moved through victim environments with living-off-the-land utilities including PsExec, PowerShell, and WMIC. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations.
Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through NTFS alternate data streams, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with AES-CBC using per-file keys protected by RSA-4096, then renamed files with victim-specific extensions such as .garminwasted or company-name variants ending in wasted, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
SentinelLabs published an analysis describing WastedLocker delivery via frameworks such as SocGholish and Cobalt Strike, along with its use of NTFS alternate data streams, privilege escalation, service-based execution, and AES/RSA file encryption.
Securelist published a technical analysis of a WastedLocker sample believed to be tailored for the Garmin attack, detailing its command-line options, UAC bypass, encryption scheme, and per-file metadata files.
SentinelLabs reported that the WastedLocker ransomware family has been tracked in the wild since approximately April or May 2020, targeting high-value organizations across multiple industries.
After the outage, Garmin confirmed that the disruption was caused by a cybersecurity incident involving data encryption. Securelist attributed the attack to a WastedLocker sample believed to be crafted specifically for Garmin.
Garmin experienced a massive service outage on July 23. Securelist later tied the incident to a targeted build of WastedLocker ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers linked **WastedLocker** to the **Evil Corp** threat group and reported that the ransomware was being used in targeted intrusions against large U.S. and enterprise victims. The operation followed a **big-game hunting** model in which attackers sought broad access across corporate networks before launching encryption, aiming to maximize business disruption and ransom pressure rather than relying on opportunistic mass infections. Investigations found the attackers commonly gained initial access through fake **Google Chrome** updates delivered via compromised websites, then used post-compromise tooling including **Cobalt Strike**, **Mimikatz**, **Empire**, **PowerSploit**, **PsExec**, **WMI**, and living-off-the-land binaries such as `msbuild.exe`. The operators conducted manual reconnaissance, stole credentials from **SAM** and **SYSTEM** hives, executed remote **PowerShell**, abused administrative shares and service execution for lateral movement, cleared event logs, attempted to disable protections such as **Windows Defender**, **Symantec Endpoint Protection**, and **Cisco AMP for Endpoints**, and in some cases created local administrator accounts and captured screenshots before deploying the ransomware.
Aug 15, 2026
**LockerGoga** hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with **MegaCortex** in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as **Cobalt Strike** before encrypting systems. The malware appended the `.LOCKED` extension, dropped ransom notes such as `README_LOCKED.txt`, and in some cases was signed with a revoked **Sectigo** certificate issued to **ALISA LTD**, likely to reduce detection. Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and **MFA**, disable `SMBv1`, audit remote access and account creation, monitor **Active Directory** changes, and enable **PowerShell** logging to detect similar intrusions earlier.
Aug 15, 2026
Mount Locker emerged as a corporate-targeting ransomware operation that stole data before encrypting files and then demanded multi-million dollar payments while threatening to leak stolen information on a Tor-hosted extortion site. Reporting on early victims said the group had already listed multiple organizations on its leak portal and published at least one victim’s files after nonpayment. The malware used **ChaCha20** for file encryption and an embedded **`RSA-2048`** public key to protect encryption material, dropped a ransom note named **`RecoveryManual.html`**, and appended a **`.ReadManual.ID`**-style extension to encrypted files. Reverse-engineering of Mount Locker samples and later variants showed the ransomware also included operational features for enterprise-wide impact, including command-line options for targeting hosts, suppressing logs, avoiding process termination controls, and encrypting network resources. Analysts reported that newer builds added worm-like lateral movement by enumerating domain or network systems, requiring **`/LOGIN=`** and **`/PASSWORD=`** parameters for propagation, copying itself to remote machines, creating services named in an **`Update{GetTickCount()}`** pattern, and in some cases launching remotely through **WMI** under **`ROOT\CIMV2`**. The malware was also described as killing selected services and processes before encryption to maximize disruption.
Aug 15, 2026