Ghostlocker

GhostLocker is a harmful malware developed by the cybercrime gang GhostSec, which has seen a significant surge in its hacking activities over the past year. The group has recently introduced an updated version of this malicious software, known as GhostLocker 2.0 ransomware, a Golang variant of the original GhostLocker ransomware. This new variant has been employed in a series of double extortion attacks against numerous countries including Cuba, Argentina, Poland, China, Lebanon, Israel, Egypt, Vietnam, Thailand, and more, according to disclosure messages posted by the group on their Telegram channels and Stormous ransomware data leak site. In a surprising departure from their past activities, GhostSec has partnered with another ransomware group, Stormous, to launch a new ransomware-as-a-service (RaaS) program named STMX_GhostLocker. This program provides various options for affiliates, enabling them to distribute ransomware more widely. The RaaS platform features a Command & Control (C2) panel that gives affiliates an overview of their attacks and gains. Cybersecurity firm Uptycs notes that this move marks a significant shift in GhostSec's operations, which have traditionally targeted Israeli entities. The development and deployment of GhostLocker 2.0 signify a turning point in the ransomware market, according to cybersecurity company SOCRadar. Despite its relatively low price and low percentage basis, the accessibility of GhostLocker could potentially escalate ransomware attacks to severe levels. Furthermore, the involvement of hacktivist collectives like GhostSec in the ransomware landscape, previously focused on political activism, indicates a diversification towards financial gain. This evolution highlights the increasing complexity and sophistication of today's cyber threats.