Loading story…
Researchers analyzed Polyglot, a ransomware family distributed through spam emails that directed victims to malicious RAR archives, and found it was designed to closely imitate CTB-Locker. The malware copied CTB-Locker’s interface, ransom workflow, Bitcoin payment model, and cryptographic presentation, while operating as an independently developed threat rather than a code-sharing variant. Once executed, Polyglot encrypted files without renaming them, established persistence through autostart entries and Task Scheduler, and communicated with a Tor-based command-and-control infrastructure via a public tor2web service.
The investigation found critical implementation flaws in Polyglot’s random number generation and ZIP password derivation, allowing encrypted files to be recovered without paying the ransom. Based on those weaknesses, researchers said victims could restore data using Kaspersky Lab’s free RannohDecryptor utility, version 1.9.3.0, turning what appeared to be a convincing CTB-Locker-style extortion campaign into a ransomware operation with an available public decryption path.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Polyglot, a ransomware family masquerading as CTB-Locker, emerged in late August and was distributed through spam emails linking to malicious RAR archives.
Because of the identified implementation flaws, files encrypted by Polyglot could be recovered using Kaspersky Lab's free RannohDecryptor utility version 1.9.3.0.
Analysis of Polyglot found flaws in its random number generation and ZIP password derivation that made recovery of encrypted files feasible. The researchers also concluded Polyglot imitated CTB-Locker but was developed independently rather than sharing its codebase.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers tied **Lyposit**, **Lucky Locker**, and **Bomba Locker** to a closely related lockscreen ransomware operation that used geographically tailored ransom pages, affiliate-style distribution, and command-and-control infrastructure to lock Windows systems. Analysis linked the malware families through shared panel behavior, similar country-specific screen designs, and overlapping technical traits, while reporting that the operation targeted victims in the United States and multiple European countries and was distributed through exploit-kit traffic including **ProPack**, **BH EK/q.php**, and **Darkleech**. Technical reviews showed a multi-stage infection chain involving a Visual Basic dropper, an intermediate loader, RC2-based decryption, and a final DLL payload that installed persistence and fetched HTML ransom content from remote servers using **BITS**, **WinINet**, and encrypted communications. The malware reportedly supported Safe Mode persistence, command processor modification, process injection, memory-only loading, antivirus evasion, and a **Windows Vista/7 UAC bypass**, while some ransom screens even mimicked a **Mac OS** interface despite infecting Windows hosts.
Aug 15, 2026
The **Yanluowang** ransomware operation targeted U.S. organizations, with a particular focus on the financial sector, using **BazarLoader** during reconnaissance and initial compromise before expanding access through enabled RDP and remote-management tools such as **ConnectWise**. Intrusions documented by Symantec and linked reporting showed the actors conducting network discovery with tools including **AdFind** and **SoftPerfect Network Scanner**, while also deploying credential-theft and data-exfiltration utilities ahead of ransomware deployment. U.S. government reporting on **FiveHands** provides additional context for tradecraft overlaps that researchers said may indicate ties to earlier ransomware-as-a-service activity, though direct shared authorship was not confirmed. A later leak of Yanluowang internal chats, infrastructure details, and source code exposed a more structured criminal enterprise, with separate roles for development, negotiations, social engineering, pentesting, and DDoS operations. The leaked material suggested links to **Thieflock**, **PayloadBIN**, **Conti**, and references to **REvil**, while indicating the group avoided targets in former Soviet states and took steps to discuss operational security and money laundering. Researchers said the leak appears to have disrupted the gang’s operations, with onion sites reportedly going offline, but warned that publication of the ransomware source code and builder could aid both defenders and future threat actors seeking to reuse the tooling.
Aug 15, 2026
FortiGuard Labs said the **DeathRansom** ransomware campaign is strongly tied to **Vidar** stealer activity and several other malware operations through shared infrastructure, naming conventions, and recurring attribution artifacts. Researchers found Vidar samples attempting to access Bitbucket paths under the profile name **`scat01`** and likely retrieving DeathRansom variants named in the **`Wacatac_YYYY-MM-DD_HH-MM.exe`** format. The same cluster was also linked to **Azorult**, **Evrial stealer**, **1ms0rryStealer**, and **Supreme miner**, with repeated use of identifiers including the nickname **`scat01`**, the email **`vitasa01@yandex.ru`**, and the domain **`gameshack[.]ru`**. FortiGuard assessed that false Slovak and Nepali language artifacts were likely planted to mislead investigators, while other evidence pointed to a Russian-speaking operator associated with the online persona **SoftEgorka** and likely connected to **Egor Nedugov** from the Rostov-on-Don/Aksay area. Separate technical profiling described DeathRansom, also detected in some cases as **Wacatac**, as a ransomware family that evolved from early variants that sometimes only mimicked encryption into later builds that performed real file encryption. The malware primarily targeted English-speaking users, dropped a **`read_me.txt`** ransom note, demanded Bitcoin payment through attacker-controlled email addresses, and checked systems against a whitelist of CIS-region languages before running. Analysts documented multiple delivery paths, including **RDP compromise**, spam, malicious downloads, botnets, exploits, malvertising, fake updates, and trojanized installers, and noted changing cryptographic implementations involving **Curve25519/ECDH**, **Salsa20**, **RSA-2048**, **AES**, and **SHA-256**. The reporting also noted code or family relationships with **EZDZ-Locker**, **TechandStrat**, **HelloKitty**, **FiveHands**, **DCRTR**, and **STOP** ransomware.
Aug 15, 2026