LockerGogaMalware
According to Trend Micro, LockerGoga is a ransomware that has been used in multiple attacks, most notably against Altran Technologies and Norsk Hydro. It encrypts a range of documents and source code files but certain versions had little to no whitelist that would protect import system files such as the Windows Boot Manager.From MISP Galaxy
Last reported 1 month ago, by Risky Business News2 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1036Masquerading
“Scripting (T1064), User Execution (T1204), and Masquerading (T1036).”
- T1110Brute Force
“…dditional modules that allow it to not only encrypt the victim’s data, but also use infected hosts to mine cryptocurrency and conduct brute force attacks against CMSs.”
- T1204User Execution
“Scripting (T1064), User Execution (T1204), and Masquerading (T1036).”
- T1204.003Malicious Image
“The vulnerabilities allow attackers to use malicious image files to run malicious code on remote services.”
- T1486Data Encrypted for Impact
“It’s T1486 – Data Encrypted for Impact.”
- T1496Resource Hijacking
“We can also identify a piece of cryptomining malware, so we also have T1496 – Resource Hijacking.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Risky Bulletin: Gemini hacked three companies too“LockerGoga dev on trial in Switzerland: A Swiss judge has sentenced a Ukrainian national to 12 years and nine months in prison for his role in ransomware attacks on local companies.”
-
50 Shades of Ransomware“A prime example is Norsk Hydro, which was infected with LockerGoga ransomware.”
Indicators in its reports
named in the reports above- itorrents[.]orgin 1 report
- hxxp://mat.tradetoolsfx[.]comin 1 report
- mat.tradetoolsfx[.]comin 1 report
- eu1-zcash.flypool[.]orgin 1 report
- onionmail[.]comin 1 report
- marktsec.bsky[.]socialin 1 report
- sethmlarson[.]devin 1 report
- shakirov2036.bsky[.]socialin 1 report
- pwn[.]aiin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.