Polyglot
- First seen
- 2021-06-01 00:00:00
- Malware type
- ransomware
- Last IoC activity
- 2026-06-21 15:55:28
- Profile updated
- 2026-07-07 15:42:56
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications
Context
Polyglot is a ransomware that imitates the behavior of CTB-Locker, using similar encryption techniques to lock users out of their assets. It primarily targets several key industries and leverages social engineering for distribution.
Detection coverage
- 2 YARA rules
Detection rules
- MALPEDIA_Win_Polyglot_Ransom_Auto (yara-rule)
- DELIVRTO_SUSP_PDF_MHT_Activemime_Sept23 (yara-rule)
Reports & references
- support.kaspersky.com — 8547 (report)
- Kaspersky — Polyglot The Fake Ctb Locker (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Polyglot Ransom (report)