Forest Global Training Partners

Cyber Risks · Cisco Talos

Player 1 Limps Back Into the Ring - Hello again, Locky!

Summary: After Kaspersky found a flaw in Jaff that allowed a decryptor to be built, the Necurs botnet switched back to distributing Locky ransomware, sending it in emails with an .exe file wrapped inside two compressed .zip archives. In the first hour of the campaign, Talos observed Locky spam accounting for up to 7.2% of email volume on one of its systems, and the attackers reused the /checkupdate path from earlier Locky campaigns in the command-and-control URL structure.

Key Takeaway: A single botnet can push a ransomware strain to 7.2% of email volume on a monitored system within an hour, and the operators reused the same /checkupdate C2 path they had used before - a signature your existing detections should already recognize.

Read the original at Cisco Talos ↗

Topics
Malware
Related