Threat Assessment: Wasted Locker Ransomware
Summary: Unit 42 reported a recent uptick in WastedLocker ransomware activity since WildFire first analyzed samples in May 2020, and NCC Group published a detailed report on the variant on June 23, 2020, attributing it to the group believed to be Evil Corp, previously responsible for the Dridex banking Trojan. The most commonly observed initial infection mechanism is ZIP files, likely disguised as legitimate software updates, containing SocGholish JavaScript loader components that profile the victim system and use PowerShell to deploy Cobalt Strike payloads for lateral movement.
Why it matters: Unit 42's AutoFocus data shows the possible targets are mostly U.S. organizations across professional and legal services, utilities and energy, manufacturing, retail, high tech, engineering, pharma and life sciences, and transportation and logistics - and the attackers prioritize systems that drive customer-facing revenue, internal systems of high visibility, and systems that contain or facilitate deployment of backups.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026