Palo Alto Networks

Locky

Everybody Gets One: QtBot Used to Distribute Trickbot and Locky

Introduction

The most common Locky and Trickbot affiliates are being distributed via shared malspam campaigns. Unit 42 and external malware researchers believe the...

Unit 42

Nov 01, 2017

By Brandon Levene, Brandon Young and Dominik Reichel

Palo Alto Networks

Products and Services

Partners

Cybersecurity

AutoFocus: Your Answer to Actionable Threat Intelligence

Threat intelligence involves learning about new attacks, adversaries, campaigns, and malware families through distinct pieces of information often referred to as indicators of compromise, or IOCs. The more we m...

Aug 23, 2016

By Stephen Perciballi

Events, News of the Week

Palo Alto Networks News of the Week – July 30, 2016

Unit 42 had a busy week! Researchers Robert Falcone and Jen Miller-Osborn observed a 9002 Trojan delivered using a combination of shortened links and a shared file hosted on Google Drive.

Jul 30, 2016

By Anna Lough

Malware, Threat Prevention, Unit 42

Afraidgate: Major Exploit Kit Campaign Switches from CryptXXX Ransomware Ba...

By mid-July 2016, the Afraidgate campaign stopped distributing CryptXXX ransomware. It is now distributing the ".zepto" variant of Locky. Afraidgate h...

Jul 29, 2016

By Brad Duncan

Events, News of the Week

Palo Alto Networks News of the Week – July 23, 2016

Unit 42 found Andromeda malware targeting Italian users in recent spam campaigns, and shared a technical walkthrough of the Office Test persistence method used in recent Sofacy attacks. The team also discovered...

Jul 23, 2016

By Anna Lough

Malware, Threat Prevention, Unit 42

PowerWare Ransomware Spoofing Locky Malware Family

Unit 42 has recently discovered a new variant of PowerWare, also known as PoshCoder, imitating the popular Locky ransomware family. PoshCoder has been encrypting files with PowerShell since 2014, and the new va...

Jul 21, 2016

By Tyler Halfpop and Jacob Soo

Healthcare, Malware

Tips to Prevent Ransomware in Healthcare Environments

If 2015 was the year of the healthcare breach, 2016 is shaping up to be the year of ransomware.By this time last year, 105 healthcare breaches had been reported to the U.S. Department of Health and Human Servic...

May 12, 2016

By Matt Mellen

Events, News of the Week

Palo Alto Networks News of the Week – April 30

We’ve rounded up all of the top Palo Alto Networks news from the past week right here.Unit 42 discussed Afraidgate, a major exploit kit campaign swapping Locky ransomware for CryptXXX. The team also highlighted...

Apr 30, 2016

By Anna Lough

Malware, Threat Prevention, Unit 42

Afraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX

In mid-April 2016, a campaign using Nuclear Exploit Kit (EK) to distribute Locky ransomware switched to using the Angler EK to install CryptXXX ransom...

Apr 28, 2016

By Brad Duncan

Events, News of the Week

Palo Alto Networks News of the Week – April 16

Join us next week for Breach Prevention Week! A full list of daily activities, April 18-22, is available here. At a glance:

Apr 16, 2016

By Anna Lough

Events, News of the Week

Palo Alto Networks News of the Week – April 9

Apr 09, 2016

By Anna Lough

Malware, Unit 42

Ransomware: Locky, TeslaCrypt, Other Malware Families Use New Tool To Evade...

Today we identified a new tool actively being used by the Locky ransomware family to evade detection and potentially infect endpoints. Unit 42 identified slight changes in Locky de...

Apr 08, 2016

By Jeff White, Chris Astacio and Micah Yates

Events, News of the Week

Palo Alto Networks News of the Week – March 26

The Palo Alto Networks threat intelligence team, Unit 42, observed Locky ransomware installed through nuclear exploit kits. Our researchers also examined the campaign evolution of Darkleech to pseudo-Darkleech...

Mar 26, 2016

By Anna Lough

Threat Prevention, Unit 42

Locky Ransomware Installed Through Nuclear EK

In February 2016, Unit 42 published detailed analysis of Locky ransomware. We certainly weren’t the only ones who saw this malware, and many others have also reported on it. Since that time, Locky has been freq...

Mar 21, 2016

By Brad Duncan

Events, News of the Week

Palo Alto Networks News of the Week – February 20

Unit 42 observed Locky, a new ransomware that mimics Dridex-style distribution. They also discovered a new Android Trojan “Xbot” that phishes credit cards and bank accounts, and encrypts devices for ransom.

Feb 20, 2016

By Anna Lough

Threat Prevention, Unit 42

Locky: New Ransomware Mimics Dridex-Style Distribution

Ransomware persists as one of the top crimeware threats thus far into 2016. While the use of document-based macros for ransomware distribution remains relatively uncommon, a new family calling itself "Locky" ha...

Feb 16, 2016

By Brandon Levene, Micah Yates and Rob Downs

Load more blogs