Spyware Stealer Locker Wiper: Locker Goga Revisited
Summary: A Dragos blog summarizing Joe Slowik's whitepaper revisits LockerGoga, the ransomware that hit Norsk Hydro on 19 March 2019, encrypting all files outside Program Files and OS directories and forcing the company to run impacted industrial systems in manual mode. Reporting from the Norwegian CERT attributed execution to a widespread compromise of Norsk Hydro's Windows Active Directory, with a malicious attachment spoofing a customer's communication as the delivery vector, and the post notes insufficient data to classify the event as state-sponsored rather than financially motivated.
Why it matters: Merck and Mondelez had cyber insurance claims denied under 'act of war' provisions after NotPetya was publicly attributed to Russia - which gives any victim of a possibly state-directed attack a financial reason to share as little as possible, leaving the actor room to operate in plain view of the authorities meant to stop it.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026