LockerGoga

LockerGoga is a type of malware, specifically ransomware, known for its disruptive capabilities. It was notably deployed at Norsk Hydro in March 2019, causing significant operational disruption. LockerGoga differentiates itself from other types of ransomware such as EKANS due to its destructive nature. The threat actors behind LockerGoga have been identified as FIN6, who traditionally targeted payment card data from Point-of-Sale (POS) or eCommerce systems. However, recent investigations by Mandiant Incident Response and FireEye Intelligence have observed FIN6 conducting intrusions deploying either Ryuk or LockerGoga ransomware, indicating a shift in their tactics. This cybercriminal group has been associated with multiple ransomware incidents showing ties to FIN6. They are known for targeting large corporations and have used various types of ransomware such as LockerGoga, MegaCortex, HIVE, and Dharma in their attacks. Once inside the system, they would remain undetected for months before deploying the ransomware and presenting a ransom note to the victim, demanding payment in bitcoin in exchange for decryption keys. Their operations have spanned 71 countries, causing losses of at least several hundred million euros. The cybersecurity firm Panda Security developed an advanced solution, Panda Adaptive Defense, which successfully detected LockerGoga via generic signatures, ensuring customer safety from this infection. In response to these threats, Swiss authorities, No More Ransom, and Bitdefender developed decryption tools for LockerGoga and MegaCortex ransomware variants, based on forensic analysis from their investigations. This development represents a significant step forward in combating the threat posed by these sophisticated ransomware variants.