Locky: New Ransomware Mimics Dridex-Style Distribution
Summary: Unit 42 observed over 400,000 individual sessions containing the Bartallex macro downloader, which dropped Locky ransomware onto victim machines, with roughly 446,000 sessions tracked and 54% targeting the United States. Locky spreads through massive phishing campaigns using Microsoft Word attachments named to match subjects like "ATTN: Invoice J-11256978," and it requires command-and-control communication for an in-memory key exchange before encrypting files.
Bottom line: Researchers suspect a link to the Dridex botnet affiliate 220, and PhishMe's napkin math - a 50% infection rate and a 1% payment rate of 0.5 bitcoins - puts the observed activity alone at several hundred thousand dollars in profit for Locky's operators.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026