Loading story…
Researchers reported a large spam campaign distributing Zepto ransomware through ZIP archives containing malicious JavaScript files, often named with a swift theme. Cisco Talos observed 137,731 emails and 3,305 unique JavaScript samples over four days, with messages using executive-themed sender personas, customized salutations, and varied subject lines to lure recipients into opening the attachment. Once launched, the script used wscript.exe to contact hardcoded command-and-control domains over HTTP, download the payload, encrypt local files, append the .zepto extension, and present ransom demands through files including _HELP_instructions.jpg and _HELP_instructions.html, along with wallpaper changes.
Technical analysis found Zepto was not a wholly new family but an evolved Locky variant with extensive code overlap. Researchers said the malware reused Locky decoding behavior, including the 321 argument, and retained largely identical encryption and file-targeting logic, while adding features such as an RDTSC-based anti-VM check. Bindiff analysis showed a 0.86 similarity coefficient, with 99.9% of Locky’s 821 functions matched in Zepto, reinforcing that the campaign represented a significant continuation of spam-delivered Locky-style ransomware activity rather than a separate threat lineage.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In July 2016, Zepto appeared as a new spam-delivered ransomware threat. Researchers reported that it encrypted files, added the .zepto extension, and dropped ransom note files named "_HELP_instructions.jpg" and "_HELP_instructions.html."
Cisco Talos said the Zepto ransomware email campaign began on Monday, 27 June, initially with about 4,000 emails observed in Cisco email security platforms. The campaign used ZIP archives containing JavaScript downloaders with the naming pattern "swift [XXX|XXXX].js."
Analysts found that the Zepto payload used an RDTSC-based anti-VM technique that caused it to kill its main thread and delete itself in the analysis environment. They patched the anti-VM instructions with NOPs, allowing the malware to run so the unpacked process could be dumped from memory after contacting domains for its RSA key.
Cisco Talos concluded that Zepto was either a new Locky variant or a ransomware family with extensive Locky copycat features. Technical analysis found the same payload decoding behavior using the argument "321" and largely identical encryption and file-targeting logic.
Over a four-day period ending with Talos's reporting, researchers identified 137,731 emails and 3,305 unique JavaScript samples distributing Zepto. Talos described the delivery chain in which the JavaScript used wscript.exe to fetch the payload from C2 domains, after which the ransomware encrypted files, appended the .zepto extension, and displayed ransom instructions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported a sharp escalation in **Locky ransomware** distribution by threat actors associated with major **Dridex** operations, including a campaign that sent **tens of millions of emails** and heavily targeted organizations in the **UK and France**. The activity relied on malicious email attachments such as **JavaScript files**, weaponized documents, and archive-based lures, showing that established banking malware operators had moved aggressively into ransomware delivery at scale. Researchers said the campaigns used a newly identified downloader, **RockLoader**, alongside layered evasion tactics including heavily obfuscated JavaScript, junk files, malformed `Content-Type` headers, **RAR archives**, and misleading or double file extensions. Proofpoint also observed RockLoader delivering multiple payloads beyond Locky, including **Dridex 220**, **Pony**, and **Kegotip**, indicating a flexible malware distribution platform that was rapidly changing code and delivery methods to bypass detection and improve infection rates.
Jun 29, 2026
HexaLocker, a Go-based Windows ransomware advertised on Telegram and linked by researchers to the actor identity **`zzart` / `@ZZART3XX`**, has evolved from an early build that encrypted user files and uploaded selected data to a newer **HexaLocker V2** strain that adds stronger persistence, obfuscation, and broader theft capabilities. Earlier analysis found the malware encrypted files under `C:\Users`, appended the **`.hexalocker`** extension, derived encryption material with **Argon2ID**, and sent keys and salts to attacker-controlled HTTPS infrastructure after protecting them with a hardcoded AES key; it also used the **GoDefender2** module for anti-analysis and anti-debugging and was promoted alongside claimed ties to **LAPSUS$** and an alliance with the **DoubleFace** ransomware gang. The newer **HexaLocker V2** version turns the operation into a clearer **double-extortion** threat by deploying the open-source **Skuld Stealer** before encryption to harvest browser data and victim files, then copying itself into **AppData**, creating a **Run** registry key for persistence, and transmitting victim metadata and encryption material to attacker infrastructure. Researchers said V2 uses **AES-GCM** for runtime string decryption, **Argon2** for key derivation, and **ChaCha20** for file encryption while appending the **`.HexaLockerV2`** extension; unlike the earlier variant, it replaces the prior **TOXID**-based victim contact method with a unique personal hash, reflecting a more mature and operationally refined ransomware campaign.
Aug 15, 2026
Threat researchers and incident responders linked **TA505** to a years-long progression from massive malspam operations delivering **Dridex**, **Locky**, **Jaff**, **GlobeImposter**, and other payloads to more targeted intrusions aimed at full-network compromise and ransomware deployment. Early campaigns relied heavily on the **Necurs** botnet and phishing lures with malicious PDFs, macro-enabled Word documents, ZIP archives, `.url` shortcuts, and `.iqy` files, while later operations introduced loaders and remote-access malware including **FlawedAmmyy**, **Marap**, **FlowerPippi**, and **Gelup**. Researchers reported that these tools supported host fingerprinting, encrypted command-and-control, persistence, privilege escalation, and delivery of follow-on payloads, showing a shift from simple malware distribution to modular access operations. The group’s later activity culminated in enterprise-wide attacks associated with **Clop** ransomware, including the compromise of **Maastricht University**, where attackers reportedly entered through phishing, escalated privileges on an unpatched system, mapped the network, harvested credentials, and encrypted **267 Windows servers**, leading the university to pay a **30 bitcoin** ransom. Separate reporting on 2020 **Dridex** campaigns showed continued use of macro-enabled documents, PowerShell downloaders, `rundll32.exe`, HTTPS command-and-control, and multiple persistence mechanisms, underscoring that TA505 maintained high-volume delivery tactics even as it adopted tools such as **Mimikatz**, **Cobalt Strike**, **WMIC**, **RDP**, **PowerSploit**, **PingCastle**, and **AdFind** to move laterally, disable defenses, and prepare domain-wide ransomware deployment and, in some cases, extortion through stolen data.
Aug 15, 2026