Newest CTB-Locker Campaign Bypasses Legacy Security Products
Summary: Unit 42 reported a CTB-Locker ransomware campaign that spreads through spear phishing emails with double-zipped SCR attachments, after which first-stage malware downloads the ransomware from a hardcoded server list. The attackers used a polymorphic malware builder to give each victim a unique hash, and Unit 42 found 147 new unique pieces of malware in a single day, two of them fully undetectable by the legacy engines in VirusTotal.
Why it matters: Most antivirus tools misidentify CTB-Locker as CryptoLocker, and last week's hashes now average 49/57 detections only after the damage is done - too late for anyone who already lost data. With IOCs largely unchanged and new hostnames still resolving to the same known malicious IP, the attackers are reusing infrastructure that signature-based defenses were never positioned to stop in time.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026