Application security, Threat Management, Malware

Locky ransomware grows rapidly in prominence, infamy, warn researchers


As industry research continues to pour in on Locky — the newly emerging ransomware responsible for locking out Hollywood Presbyterian Medical Center, it is becoming clear that the malicious code is propagating rapidly in the U.S. and across the globe.

Locky's accelerated distribution was noted in recent advisories from leading security firms Heimdal Security and Palo Alto Networks. The latter, in a Feb. 16 blog post, said it “observed approximately 446,000 sessions for this threat, over half of which targeted the United States (54 percent).”

But Locky's global reach is expanding as well, as evidenced by today's Heimdal blog post, which analyzes an email spam campaign designed to trick German-language targets into downloading the ransomware. In this instance, the spoofed emails appear to come from MPSMobile, a mobile device accessory wholesaler. MPSMobile's homepage today features a prominent security advisory warning customers not to fall for the email-based scam.

The spam emails spread Locky via malicious Word attachments as well as via macros that, upon activation, connects a victim's PC to a malicious web page. Researchers have also noted a distinct link between Locky and the known banking malware Dridex, believing them to be the handiwork of the same bad actors.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.