Ransomware

Understanding Locky

19 February 2016 ~6 min By vlad
Research Malware Ransomware
A few days ago I was asked to have a look at the newly emerged crypto-ransomware threat “Locky” which utilises Dridex-like Command and Control (C&C) communications techniques. For some background reading, I recommend you read the following: http://sensorstechforum.com/aes-128-encryption-employed-by-locky-ransomware/ https://nakedsecurity.sophos.com/2016/02/17/locky-ransomware-what-you-need-to-know/) http://www.theinquirer.net/inquirer/news/2447460/dridex-style-locky-ransomware-is-infecting-machines-via-microsoft-word It looks like a new (FEB2016) addition to the crypto-ransomware family : 1. Dirty Decrypt 2. CryptoLocker 3. CryptoWall / Cryptodefense 4. Critroni / CTB Locker 5. TorrentLocker 6. Cryptographic Locker 7. TeslaLocker 8. Locky