Locky
Aliases: Locky-Odin, Locky-Osiris, Locky-Osiris 2016, Locky-Osiris 2017
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-22 03:55:48
- Profile updated
- 2026-07-07 15:42:48
Targeted industries: financial-services healthcare-and-pharmaceutical education-and-nonprofits government-and-public-sector retail-and-hospitality
Context
Ransomware Affiliations with Dridex and Necurs botnets
Detection coverage
- 3 YARA rules
Detection rules
- CAPE_Locky (yara-rule)
- MALPEDIA_Win_Locky_Auto (yara-rule)
- MALPEDIA_Win_Locky_Decryptor_Auto (yara-rule)
Reports & references
- bleepingcomputer.com — New Locky Version Adds The Zepto Extension To Encrypted Files (report)
- Trend Micro — New Locky Ransomware Spotted In The Brazilian Underground Market Uses Windows Script Files (report)
- nakedsecurity.sophos.com — Odin Ransomware Takes Over From Zepto And Locky (report)
- bleepingcomputer.com — Locky Ransomware Switches To Egyptian Mythology With The Osiris Extension (report)
- id-ransomware.blogspot.com — Locky (report)
- ransomlook.io — Locky (report)
- Trend Micro — Ransomware As A Service Enabler Of Widespread Attacks (report)
- ESET — Eset Threat Report Q22020 (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 006 (report)
- cert.ssi.gouv.fr — Certfr 2020 Cti 009 (report)
- blog.intel471.com — A Brief History Of Ta505 (report)
- intel471.com — A Brief History Of Ta505 (report)
- elastic.co — Ten Process Injection Techniques Technical Survey Common And Trending Process (report)
- gdatasoftware.com — 31666 Ransomware Identification For The Judicious Analyst (report)
- storage.googleapis.com — Ce44Cbda9Fdc061050C1D2A5Dec0270874A9Dc85 (report)
- web.archive.org — Return Of Fake Ups Cannot Deliver Malspam With An Updated Nemucod Ransomware And Kovter Payload (report)
- McAfee — Evolution Of Malware Sandbox Evasion Tactics A Retrospective Study (report)
- McAfee — Evolution Of Malware Sandbox Evasion Tactics A Retrospective Study (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Locky (report)
- dissectingmalwa.re — Picking Locky (report)
- Cisco Talos — Necurs Locky Campaign (report)
- thisissecurity.stormshield.com — De Obfuscating Jump Chains With Binary Ninja (report)
- blog.malwarebytes.com — Look Into Locky (report)
- bleepingcomputer.com — Locky Ransomware Switches To The Lukitus Extension For Encrypted Files (report)
- vixra.org — 2002.0183V1 (report)