Born This Way? Origins of Locker Goga
Summary: Unit 42 analyzed 31 ransomware samples similar to the LockerGoga variant first reported in January after attacks on Altran Technologies, Norsk Hydro, Hexion and Momentive, and found the name came from a source code path string absent from the original Altran sample. The earliest sample, submitted to VirusTotal on January 24, requires administrative privileges, spreads only by manual SMB file copying with no worm capability, and encrypts files in 80,000-byte chunks using RSA-OAEP MGF1(SHA-1).
Bottom line: The developers added undocumented Windows API calls such as NtQuerySection and imported WS2_32.dll, which Unit 42 says could lead to command-and-control communication or automated propagation - and the malware was observed encrypting core Windows system files and crashing a Windows 2012 machine despite its denylist.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026