Tuesday, April 1, 2025
HomeRansomwareEverything you Need to Know About The Evolution of Locky Ransomware

Everything you Need to Know About The Evolution of Locky Ransomware

Published on

SIEM as a Service

Follow Us on Google News

The onset of Locky Ransomware campaign was thought to be evolutionary, but around the clock the campaign has grown to be revolutionary.

We had been monitoring and sharing Locky campaign updates since last month till date. It was observed that almost 23 million messages were sent in last 24-hour period, making it one of the largest malware campaigns seen in the latter half of 2017.

Locky Ransomware

Ransom Notes From Locky Ransomware

The other day 711 million addresses were found to be leaked onto the internet by Online Spambot. The profound dump had found coherencies with recent Locky malspam activities.

The analysis of the thousands of emails sent in the campaign revealed this attack data: 11,625 different IP addresses in 133 different countries are being used to perform this campaign and also Spreading via spoofing Dropbox.

The countries housing the most attack servers are Vietnam, India, Mexico, Turkey, and Indonesia.

The evolution focused on changing tactics mid-game and experimenting with new extensions or new baits to get unsuspecting users to click.

Key Attributes of Locky Ransomware

The late August campaign uses the IKARUS dilapidated version of Locky, which had the .lukitus extension. It spreads using a botnet of zombie computers responsible for coordinating a phishing attack.

While some of the campaigns were also seen spreading with a ZIP attachment that contains a Visual Basic Script (VBS) file that is nested inside a secondary ZIP file.
Once clicked, VBS file initiates a downloader that reaches out to the malicious domain to pull down the latest Locky ransomware.

Additional capricious characteristics included the malicious documents exhibiting harmless behavior in many sandboxes while still infecting end users.

In the latest spam run, the ransomware infection has been resorted to spoofing Dropbox. And accessing the malicious dropbox websites drops Locky payload.

Locky Ransomware

C&C Server Communication for Download Locky Ransomware

Recently we had seen in HoeflerText camapaign, website generates a bogus popup message informing the user the webpage they are trying to view cannot display correctly because the browser is missing the correct “HoeflerText” font.

The message then prompts the user to fix the error. When clicked, receives a JavaScript file which is designed to download and install Locky ransomware

Detection Tips

  • Locky ransomware uses registry keys (shared in IOCs – Locky Ransomware) for persistence. Therefore, it is important to monitor registry keys for infection detection.
  • A domain check rule for Dropbox access can be created incorporating to enhance visibility.

Prevention Tips

  • Most of the trusted antimalware solutions have found quipped with signatures to detect and stop execution of Locky ransomware.
  • As maldoc is found to be the source in some of the Locky infection, it is advisable to disable the usage of macros in Microsoft Office applications (MS-Word).
  • A rule can be created for email gateway devices which can generate alerts upon receipt of attachment with MS-Office extensions (xls|xlsx, doc|docx, ppt|pps etc.) from unknown sources and/or found with binary contents.
  • Block the IP, URLs, file hashes that have identified in connection with the campaigns and spreading malware. Please refer the attachment IOCs – Locky Ransomware.xlsx for details.

Latest articles

Chord Specialty Dental Partners Data Breach Exposes Customer Personal Data

Chord Specialty Dental Partners is under scrutiny after revealing a data breach that compromised...

Kentico Xperience CMS XSS Vulnerability Allows Remote Code Execution

Kentico Xperience CMS, a widely used platform designed for enterprises and organizations, is under...

LensDeal Data Breach Exposes 100,000 Customers’ Personal Information

A major data breach involving LensDeal, a Netherlands-based contact lens supplier, has reportedly exposed...

Apple Issues Warning on Three 0-Day Vulnerabilities Under Active Exploitation

Apple has issued an urgent security advisory concerning three critical zero-day vulnerabilities – CVE-2025-24200, CVE-2025-24201, and CVE-2025-24085 –...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Weaponized Zoom Installer Used by Hackers to Gain RDP Access and Deploy BlackSuit Ransomware

Cybersecurity researchers have uncovered a sophisticated attack campaign where threat actors utilized a trojanized...

Beware! A Fake Zoom Installer Drops BlackSuit Ransomware on Your Windows Systems

Cybersecurity analysts have uncovered a sophisticated campaign exploiting a fake Zoom installer to deliver...

ClickFix Captcha – A New Technique Hackers Used to Deliver Infostealers, Ransomware, & Quakbot Malware

Cybercriminals are leveraging fake CAPTCHA verification pages dubbed ClickFix to distribute malware, including infostealers,...