Loading story…
LockerGoga hit large organizations across the United States and Europe, including reported victims such as Norsk Hydro, Altran, Hexion, and MPM Holdings, while the FBI later warned that the threat overlapped with MegaCortex in targeting enterprise networks. Investigators said the operators typically gained initial access through exploits, phishing, SQL injection, and stolen credentials, then spent weeks or months moving laterally with tools such as Cobalt Strike before encrypting systems. The malware appended the .LOCKED extension, dropped ransom notes such as README_LOCKED.txt, and in some cases was signed with a revoked Sectigo certificate issued to ALISA LTD, likely to reduce detection.
Researchers said LockerGoga blurred the line between ransomware and a wiper because later variants forcibly logged users off Windows systems, blocked them from logging back in, disabled network interfaces, changed local passwords, and could even clear Windows Event Logs and encrypt files in the Recycle Bin. Reporting indicated the malware did not appear to self-propagate, but once attackers had domain access they could disable security tools and deploy it broadly across compromised environments. The FBI urged organizations to maintain offline backups, patch exposed systems, enforce strong passwords and MFA, disable SMBv1, audit remote access and account creation, monitor Active Directory changes, and enable PowerShell logging to detect similar intrusions earlier.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The FBI said LockerGoga had targeted large corporations and organizations in the United States, United Kingdom, France, Norway, and the Netherlands since January 2019.
Cisco Talos reported that a LockerGoga campaign in January used the ransom note filename "README-NOW.txt" instead of the more typical "README_LOCKED.txt."
The FBI issued a Flash Alert warning private industry about LockerGoga and MegaCortex ransomware, describing them as enterprise-focused threats that compromise networks before encrypting devices.
The Center for Internet Security released a primer containing current information and known indicators of compromise for LockerGoga.
Emsisoft released a free decrypter for Aurora ransomware, also known as Zorro, Desu, and AnimusLocker.
F-Secure released a free decryption tool for Mira ransomware victims and said it must be run on the original infected computer after the malware is removed.
Cisco Talos analyzed LockerGoga's behavior, including file encryption, log clearing, lack of self-propagation, and later variants that forcibly logged users off and blocked them from logging back in.
Cisco Talos reported that several LockerGoga samples were signed with a certificate issued to ALISA LTD by Sectigo, and that the certificate was later revoked.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcembsd.jp
Open sourcehelpnetsecurity.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how **WastedLocker** was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as **SocGholish** and **Cobalt Strike**, then moved through victim environments with living-off-the-land utilities including **PsExec**, **PowerShell**, and **WMIC**. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations. Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through **NTFS alternate data streams**, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with **AES-CBC** using per-file keys protected by **RSA-4096**, then renamed files with victim-specific extensions such as `.garminwasted` or company-name variants ending in `wasted`, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Aug 15, 2026
Security researchers linked **WastedLocker** to the **Evil Corp** threat group and reported that the ransomware was being used in targeted intrusions against large U.S. and enterprise victims. The operation followed a **big-game hunting** model in which attackers sought broad access across corporate networks before launching encryption, aiming to maximize business disruption and ransom pressure rather than relying on opportunistic mass infections. Investigations found the attackers commonly gained initial access through fake **Google Chrome** updates delivered via compromised websites, then used post-compromise tooling including **Cobalt Strike**, **Mimikatz**, **Empire**, **PowerSploit**, **PsExec**, **WMI**, and living-off-the-land binaries such as `msbuild.exe`. The operators conducted manual reconnaissance, stole credentials from **SAM** and **SYSTEM** hives, executed remote **PowerShell**, abused administrative shares and service execution for lateral movement, cleared event logs, attempted to disable protections such as **Windows Defender**, **Symantec Endpoint Protection**, and **Cisco AMP for Endpoints**, and in some cases created local administrator accounts and captured screenshots before deploying the ransomware.
Aug 15, 2026
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026