WastedLocker

WastedLocker is a sophisticated malware developed by the Evil Corp Group, a notorious cybercriminal organization. This malware is a form of ransomware that targets both Windows and Android devices, encrypting users' data and demanding a ransom for its release. Originating in 2020, WastedLocker utilizes a Delphi-based crypter known as CryptOne, which has been in use since 2015 and is offered as a Crypter-As-A-Service. CryptOne has been associated with various malware families over the years, including Gozi, Dridex, NetWalker, and, most notably, WastedLocker. The development of WastedLocker came about after a significant shift within the Evil Corp Group. Following the departure of a key member, Turashev, the remaining group, led by Yakubets and Ryzhenkov, began developing this new ransomware variant. The National Crime Agency (NCA) identified Ryzhenkov as a crucial figure in the development of Evil Corp's post-sanctions WastedLocker ransomware, a Ransomware-as-a-Service (RaaS) offering. Despite sanctions and changes in tactics, some members continued to develop further malware and ransomware strains, including WastedLocker, Hades, PhoenixLocker, PayloadBIN, and Macaw. WastedLocker has been used in several high-profile attacks, including those targeting major US companies and newspaper websites operated by a US media company. Attackers have also used a tool called SocGholish as a primer for ransomware, including WastedLocker. Notably, WastedLocker includes a list of directories and extensions to exclude from the encryption process, rather than targeting specific extensions. Additionally, a sample crypted by the CryptOne crypter as used by WastedLocker has been found capable of detecting and disabling a list of security software, demonstrating the malware's advanced capabilities.