Locker Ransomware

Locker ransomware, a type of malware, poses significant risks to computer systems and data. Unlike crypto-ransomware which encrypts user data, locker ransomware locks users out of their devices entirely, demanding a ransom payment to restore access without any data encryption. This threat has evolved over time, with hybrid ransomware variants emerging that combine elements of both encrypting and locker ransomware. One such variant is the Dagon Locker Ransomware, recently analyzed by The DFIR Report, which demonstrated attackers leveraging AWS knowledge for internal movement within an AWS account and data exfiltration. The Rorschach locker ransomware, named due to its varied appearances, exhibits a partly autonomous, self-propagating nature and employs hybrid cryptography. Instead of encrypting entire files, it encrypts only parts, allowing it to operate at high speeds. In tests conducted by Check Point, Rorschach encrypted 22,000 files in an average of four minutes and 30 seconds. On the other hand, Ragnar Locker ransomware, operational since December 2019, is considered one of the most dangerous due to its attacks on critical infrastructure worldwide. Mitigating locker ransomware risks involves awareness of potential threats like phishing attacks and unsafe browsing habits. Recommended preventive measures include multi-factor authentication (MFA), regular system monitoring and patching, implementing a data backup and recovery plan, and network segmentation. For instance, the final stage of a Ryuk attack involves compromising the environment, extracting valuable data, then using locker ransomware to lock the machine and encrypt files in the background. As such, proactive defense strategies are crucial in preventing locker ransomware infiltration.