Pumpkin Spiced Locky
Summary: Cisco Talos observed three spam campaigns distributing a new Locky ransomware version on 2016-10-24, after roughly a two-week pause: one sent 13,384 emails with .HTA downloaders in .ZIP archives using the subject "Receipt XXX-XXX" and the word "PUMPKIN" in 37 obfuscation instances, a second sent 3,748 "Complaint letter" emails with .JS downloaders over a three-hour window, and a third sent 154 emails with .WSF downloaders, 133 of them French-language messages posing as bills from the provider "Free". The new Locky build uses the .shit file extension, and Talos said the third campaign's attachments were often corrupt, which it assessed as a possible small test campaign.
Bottom line: A single morning's wave put more than 17,000 malicious emails in front of recipients across three downloader types, and 133 of the 154 messages in the smallest campaign were tailored to French speakers - the volume and the localization are the point, not the Halloween-themed variable names.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026