Without Necurs, Locky Struggles
Summary: Cisco Talos reported that Locky spam volume has dropped sharply since late December while the Necurs botnet is offline, with new campaigns delivering fewer than a thousand messages instead of the usual hundreds of thousands. The campaigns used blank emails with double-extension zip and JSE attachments, and one delivered both the Kovter Trojan and Locky, while Talos noted blocklist IPs tied to spamming fell from roughly 350-400K to about 50K.
What's compelling: Paying the Locky ransom in the first campaign still left Kovter running on the system, and Necurs going quiet only removed the volume - Talos expects something else to fill that void.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026