darkylock
- First seen
- 2022-07-01 00:00:00
- Malware type
- ransomware
- Last IoC activity
- 2026-07-02 20:39:16
- Profile updated
- 2026-07-07 13:58:16
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
Darky Lock is a commodity-style ransomware strain first identified in July 2022, derived from publicly available Babuk source code. Victim systems undergo file encryption with an added “.darky” extension, and a “Restore-My-Files.txt” ransom note is placed in all impacted locations. The malware attempts to disable backup mechanisms, including shadow copies and specific applications. Its distribution leverages phishing and trojanized installers, complemented by payloads dropped via frameworks like Empire, Metasploit, and Cobalt Strike.
Reports & references
- ransomlook.io — Darkylock (report)
- sentinelone.com — Darky Lock (report)
- pcrisk.com — 24283 Darky Lock Ransomware (report)
- bazaar.abuse.ch — Darkylock (report)