Loading story…
HexaLocker, a Go-based Windows ransomware advertised on Telegram and linked by researchers to the actor identity zzart / @ZZART3XX, has evolved from an early build that encrypted user files and uploaded selected data to a newer HexaLocker V2 strain that adds stronger persistence, obfuscation, and broader theft capabilities. Earlier analysis found the malware encrypted files under C:\Users, appended the .hexalocker extension, derived encryption material with Argon2ID, and sent keys and salts to attacker-controlled HTTPS infrastructure after protecting them with a hardcoded AES key; it also used the GoDefender2 module for anti-analysis and anti-debugging and was promoted alongside claimed ties to LAPSUS$ and an alliance with the DoubleFace ransomware gang.
The newer HexaLocker V2 version turns the operation into a clearer double-extortion threat by deploying the open-source Skuld Stealer before encryption to harvest browser data and victim files, then copying itself into AppData, creating a Run registry key for persistence, and transmitting victim metadata and encryption material to attacker infrastructure. Researchers said V2 uses AES-GCM for runtime string decryption, Argon2 for key derivation, and ChaCha20 for file encryption while appending the .HexaLockerV2 extension; unlike the earlier variant, it replaces the prior TOXID-based victim contact method with a unique personal hash, reflecting a more mature and operationally refined ransomware campaign.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On August 9, 2024, the HexaLocker group announced a new Windows ransomware on Telegram, describing it as Go-based and promoting data exfiltration and anti-analysis features. Cyble also noted the group claimed ties to LAPSUS$ and other groups.
Synacktiv reported that HexaLocker samples had been available on VirusTotal since July 2024, indicating the malware was already evolving before its public promotion.
Cyble Research and Intelligence Labs identified a new Windows variant, HexaLocker V2, which added persistence, stronger obfuscation, browser-data theft via the Skuld stealer, pre-encryption file exfiltration, and ChaCha20-based encryption with the .HexaLockerV2 extension.
PJ04857920 reported on December 12 that HexaLocker had been revived and showed signs of ongoing development and activity.
Researcher PJ04857920 reported on October 21 that the HexaLocker administrator had shut down the operation and was offering the source code and web panel for sale.
Synacktiv published technical analysis of an early HexaLocker sample, documenting its anti-analysis checks, Argon2ID-based key derivation, AES-GCM file encryption, and theft of encrypted files uploaded to attacker infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**MedusaLocker** has continued to evolve from its 2019 origins into a mature ransomware operation that targets enterprise networks through exposed or weakly secured **RDP**, stolen or brute-forced credentials, phishing, spam, and vulnerable VPN or edge devices. U.S. government reporting has described the threat as a **ransomware-as-a-service** model in which affiliates conduct intrusions and share proceeds with developers, while multiple technical profiles show the malware encrypting local disks, mapped drives, accessible **SMB** shares, and broader network resources after gaining a foothold. Later variants, including **MedusaLocker v3** or **BabyLockerKZ**, also steal data to support **double extortion** and focus on maximizing damage inside victim environments rather than relying on external command-and-control traffic. Across variants, MedusaLocker uses **AES-256** encryption with **RSA-2048** key protection, deletes shadow copies and backups to hinder recovery, and establishes persistence through scheduled tasks, roaming-profile executables, and registry-based mechanisms such as `HKCU\SOFTWARE\PAIDMEMES` or `HKEY_CURRENT_USER\SOFTWARE\MDSLK\Self`. Researchers and government agencies report additional behaviors including PowerShell execution, safe-mode reboots to impair defenses, UAC bypass, process termination to unlock files, ICMP network sweeping, CIDR-aware share discovery, hidden-volume mounting, and self-relaunch with a `-network` argument to widen encryption. The malware has used changing file extensions such as `.meduza216` and varying ransom note names including **How_to_back_files.html**, **HOW_TO_RECOVER_DATA**, and related templates, with victims reported across healthcare, finance, government, and manufacturing.
Aug 15, 2026
LockBit expanded its ransomware-as-a-service operations with **StealBit**, a custom exfiltration tool used by affiliates to steal data before encryption and support double-extortion demands. Research shows StealBit was built for high-throughput theft, using named-pipe interprocess communication via `STEALBIT-MASTER-PIPE` and Windows I/O completion ports to parallelize transfers, while sending stolen file contents over HTTP `PUT` requests to attacker-controlled infrastructure embedded in the malware. Analysts also found anti-analysis checks, encrypted strings and endpoint data, and later versions that added self-deletion, transfer throttling, and partial window-hiding, although some advertised features such as hidden execution and compression were incomplete or misleading in examined samples. The tool formed part of the broader **LockBit 2.0** playbook, which resurfaced as a more aggressive operation combining rapid encryption, data theft, and automated spread across Windows domains through Active Directory group policies. Trend Micro reported detections tied to LockBit 2.0 activity in Chile, Italy, Taiwan, and the UK, noting that affiliates also abused legitimate tools such as Process Hacker and PC Hunter and used scripts to disable defenses, stop services, and clear logs. The ransomware partially encrypted files, appended the `.lockbit` extension, dropped `Restore-My-Files.txt` ransom notes, and threatened to leak stolen data, while later research tracked the gang’s exfiltration infrastructure as defenders worked to hunt StealBit-related activity.
Aug 14, 2026
Researchers reported a large spam campaign distributing **Zepto** ransomware through ZIP archives containing malicious JavaScript files, often named with a `swift` theme. Cisco Talos observed **137,731 emails** and **3,305 unique JavaScript samples** over four days, with messages using executive-themed sender personas, customized salutations, and varied subject lines to lure recipients into opening the attachment. Once launched, the script used `wscript.exe` to contact hardcoded command-and-control domains over HTTP, download the payload, encrypt local files, append the **`.zepto`** extension, and present ransom demands through files including `_HELP_instructions.jpg` and `_HELP_instructions.html`, along with wallpaper changes. Technical analysis found Zepto was not a wholly new family but an evolved **Locky** variant with extensive code overlap. Researchers said the malware reused Locky decoding behavior, including the `321` argument, and retained largely identical encryption and file-targeting logic, while adding features such as an `RDTSC`-based anti-VM check. Bindiff analysis showed a **0.86 similarity coefficient**, with **99.9%** of Locky’s 821 functions matched in Zepto, reinforcing that the campaign represented a significant continuation of spam-delivered Locky-style ransomware activity rather than a separate threat lineage.
Aug 15, 2026