mobilespy.atspace.co.uk
Locky ransomware returns to the game with two new flavors | Advanced Mobile Spy Software
We recently observed a fresh malicious spam campaign pushed through the Necurs botnet distributing so far, two new variants of Locky ransomware. In our last Q2 2017 report on tactics and techniques, we mentioned that Locky ransomware had reappeared with a new extension, but went dark again for months. From August 9th, Locky made another reappearance using a new file extension ".diablo6" to encrypt files with the rescue note: "diablo6-[random].htm". Today a new Locky malspam campaign is pushing a new Locky variant that adds the extension ".Lukitus" and the rescue note: "lukitus.html". Locky, like numerous other ransomware variants, is usually distributed with the help of spam emails containing a malicious Microsoft Office file or a ZIP attachment containing a malicious script. Locky variants, callback to a different command and control server (C2) and use the affiliate id: AffilID3 and AffilID5. Over the last few months, Locky has drastically decreased its distribution, even failed to