Threat Spotlight: Mighty Morphin Malware Purveyors: Locky Returns Via Necurs
Summary: Cisco Talos observed the first large-scale Locky ransomware campaign in months on April 21, distributed through the Necurs botnet, with more than 35,000 emails seen in a matter of hours. The campaign used PDF attachments with embedded Word documents whose XOR'd macros downloaded the Locky sample from a likely compromised website, a delivery technique recently used to distribute Dridex.
Why it matters: The PDF-with-embedded-Word-document chain requires the user to click through a pop-up before the macro runs, which defeats sandboxing technologies that do not allow user interaction and raises the odds the payload reaches an end user's mailbox.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026