dataf locker
- First seen
- 2024-01-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:54:46
Targeted industries: government-and-public-sector healthcare-and-pharmaceutical financial-services manufacturing retail-and-hospitality
Context
DataF Locker is a ransomware variant first observed in 2024, closely tied to the Babuk ransomware lineage. It operates under a double-extortion model, encrypting files by appending the .dataf extension and threatening to leak exfiltrated data if the ransom isn't paid. Victims receive a ransom note named How To Restore Your Files.txt, with satisfaction of specified recovery procedures. Observations suggest use of typical intrusion vectors such as phishing, exploit tools, or leaked credential abuse, although detailed delivery methods and leak infrastructure remain under-documented in high-tier intelligence reports.
Reports & references
- ransomlook.io — Dataf Locker (report)
- pcrisk.com — 25442 Dataf Locker Ransomware (report)