Amigo-A@Amigo_A_
A new article #LockFile #Ransomware
Another group that uses legitimate technology to attack.
No public sample. Hash VT is in Symantec's article.
The LockFile site look ala LockBite site.
049
Posts with #LockFile
#LockFile
Public posts on X that use #LockFile.
Related hashtags
Emanuele De Lucia@Manu_De_Lucia#LockFile #Ransomware 0x100017c0 <> 0x10001330 3a4b6d3685ddbcc18d607cd7a4c2844e <> 957af740e1d88fabdaf73bd619cb3d31 #loader of 'desktop.ini' and 'kavs' || file name: 'active_desktop_render.dll' seems to share chucks with #APT10 #MenuPass #StonePanda 🧐🤔
21562
Based on @vinopaljiri published analysis and weaknesses he found in #AtomSilo and #LockFile ransomware, we created free Avast #decryptor for both of them. Read and download.01734
— A THREAD — [1/5] #Rook is a double extortion #ransomware first spotted in December 2021. @TrendMicro has since detected it in eight countries across the globe and researchers have traced Rook’s origin to China. See its ransom note:
104
The Hacker News@TheHackersNewsNew #LockFile ransomware family that emerged last month uses a novel technique known as "intermittent #encryption" to bypass behavioral and statistical-based #ransomware protection. Details: #infosec #cybersecurity #hacking272108
It appears that a file used in the LockFile attack has similarities to a previous sample attributed to APT10. It's an interesting find, so I took a quick look at it. #APT #lockfile #Ransomware Thread👇Emanuele De Lucia @Manu_De_Lucia#LockFile #Ransomware 0x100017c0 <> 0x10001330 3a4b6d3685ddbcc18d607cd7a4c2844e <> 957af740e1d88fabdaf73bd619cb3d31 #loader of 'desktop.ini' and 'kavs' || file name: 'active_desktop_render.dll' seems to share chucks with #APT10 #MenuPass #StonePanda 🧐🤔12677
Anonymous🐾🐈⬛@YourAnonRiotsNew #LockFile ransomware family that emerged last month uses a novel technique known as "intermittent #encryption" to bypass behavioral and statistical-based #ransomware protection. #infosec #cybersecurity #hacking044
Arkbird@Arkbird_SOLGI share additional samples (+ hunting) and yara rules of the toolset of #LockFile (loader,tools,ransomware...) H/T @JAMESWT_MHT for the samples Samples: Yara : Article :21656
#LockFile #Ransomware Uses Never-Before Seen #Encryption to Avoid Detection. Researchers from @Sophos discovered exploits the #ProxyShell #vulnerabilities in @Microsoft Exchange servers to attack systems. @dynamicCISO #girlswhocode #100daysofcode026
SentinelOne@SentinelOne😈 Watch how SentinelOne prevents and remediates from LockFile Ransomware. Associated with PetitPotam and ProxyShell exploitation, the LockFile ransomware family was seen in the wild starting June of 2021. #ransomware #infosec #LockFile #IT #endpointprotection002
Wang Wei@security_wangNew #LockFile ransomware family that emerged last month uses a novel technique known as "intermittent #encryption" to bypass behavioral and statistical-based #ransomware protection. Details: #infosec #cybersecurity #hacking001
TG Soft@VirITeXplorer2021-08-24 Update #LockFile #ProxyShell saga For the #LockFile ransomware attack was used 668544844.aspx webshell in this timeline: 18/08/2021 45.61.136.146 (ws created) -> 193.176.211.29 19/08/2021 45.146.54.62 -> 193.176.211.29 -> LockFile @GossiTheDog @58_158_177_102
11636- Emanuele De Lucia@Manu_De_LuciaIt seems there are some overlaps between #LockFile and the new #AtomSilo #ransomware. On the basis of the comparison, more or less 10/20% seems to be reused code on the total of the unpacked samples. x1 sample md5:81f01a9c29bae0cfa1ab015738adc5cc #unpacked @Amigo_A_
S!Ri @siri_urz.ATOMSILO #Ransomware 04A8307259478245CBAE49940B6D655A1210 
Mark Loman@marklomanLockFile ransomware’s box of tricks: intermittent encryption and evasion #proxyshell #petitpotam #lockfile025
Stéphane Nappo@StephaneNappo#LockFile #Ransomware #Infosec #CyberAwareness #CISO The #CyberSecurity and Infrastructure Security Agency (#CISA) issued an emergency alert over #MicrosoftExchange #ProxyShell vulnerabilities being actively exploited by threat actors in the wild.076
Sample on Virustotal - 0 AV detection rate But our generic YARA rule that we've shared with the community and looks for a combination of PST header and ASPX contents triggered on such files days before #Lockfile ransomware related samples appearedTG Soft @VirITeXplorer2021-08-24 Update #LockFile #ProxyShell saga For the #LockFile ransomware attack was used 668544844.aspx webshell in this timeline: 18/08/2021 45.61.136.146 (ws created) -> 193.176.211.29 19/08/2021 45.146.54.62 -> 193.176.211.29 -> LockFile @GossiTheDog @58_158_177_10201966- TG Soft@VirITeXplorer@VirITeXplorerNext step with #EfsPotato was launched #VatetLoader active_desktop_launcher.exe that loaded active_desktop_render.dll that decrypt and load the file desktop.ini that contains #cobaltstrike (2/n)124
- TG Soft@VirITeXplorer@VirITeXplorerCriminals set a group policy script that run in all the network pc the #ransomware #LockFile (mimic the #LockBit graphics) (3/n)
119 
HalfStack Events@halfstackconfThe third speaker of the event. @lukekarrys with Performing Laparoscopic Lockfile Surgery. #Lockfile #HalfStack #Phoenix
039230
HelpshiftEng@HelpshiftEngThe package.lock.json is an important file in your npm project. Here's a detailed guide by @CompileZero that explains how package-lock.json works. #npm #lockfile #frontend #javascript #packagelock022- TG Soft@VirITeXplorer2021-08-19 #LockFile #Ransomware via #Exchange #ProxyShell #EfsPotato #VatetLoader #CobaltStrike hit Italy 🇮🇹 We have analyzed a case of attack by #LockFile #Ransomware that used Exchange exploit and group policy to attack an entire network. @58_158_177_102 @siri_urz @reecdeep
24488 - TG Soft@VirITeXplorer@VirITeXplorerIOC: 4CFEA3D23AA4ECE7A22EF13F47A393A9 10CC7D7DE5EF85D104171B4255BDCA54 07F96C3910106C7FE9153A8ADCB9785A 71E208A8D7CC9EC9D08E0BF5C0329AE6 76280746B3F8685EAAD6879A6D9456C5 335B9A537A380EC5936A7210AD64D955 A8DDACE9435FE395325FC45DDE8BD0A3 957AF740E1D88FABDAF73BD619CB3D31 (4/n)117
- TG Soft@VirITeXplorer@VirITeXplorer08333352F5AF9E610F356EE5B1C31EE0 8ED32ACE2FBCE50296D3A1A16D963BA7 BC70A7B384558CAFBBC04F00A59CBE8D 8D17765168677EF76400B497FB0C0FD3 EF37842FC159631F9DD8F94C5E05A674 -> #ransomware #LockFile (end)016
- Show more posts
