LockerGoga

LockerGoga is a type of malware, specifically ransomware, that infiltrates computer systems and holds data hostage until a ransom is paid. This malicious software was notably deployed in an attack against Norsk Hydro in March 2019. The malware was distributed by the threat group FIN6, which traditionally targeted payment card data from Point-of-Sale (POS) or eCommerce systems. However, they expanded their operations to include targeted ransomware attacks, such as those involving LockerGoga and Ryuk. FireEye's Mandiant Incident Response investigations and intelligence research have identified connections between FIN6 and multiple instances of these ransomware attacks. The deployment of LockerGoga involves the use of batch script files, with Psexec being used for executing batch and PowerShell scripts and the final execution of LockerGoga across as many devices as possible. The LockerGoga ransom note is presented to victims after the malware has been undetected in compromised systems for some time, often months. The criminals demand payment in bitcoin in exchange for decryption keys. The threat actors are affiliates of various ransomware operations, including LockerGoga, MegaCortex, HIVE, and Dharma, and are known for targeting large corporations. Despite the potential devastation caused by LockerGoga, there are defenses available. For instance, Panda Adaptive Defense, an advanced cybersecurity solution combining EPP and EDR systems, was able to detect LockerGoga via generic signatures, effectively protecting its customers from infection. If individuals or companies are affected by LockerGoga, tools are available to recover files for free. As the fight against ransomware continues, it is crucial to implement robust cybersecurity strategies to prevent future infections.