{
  "family": "locky",
  "sample_count": 11,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nLocky is an extremely notorious, historically devastating strain of enterprise ransomware that first appeared in 2016. It was responsible for some of the most widespread and costly cyberattacks globally, notoriously shutting down hospitals and large corporations. While its prevalence has declined in favor of more modern targeted ransomware (like Conti or LockBit), its aggressive encryption algorithms, rapid network propagation capabilities, and sophisticated evasion techniques made it a defining threat of the modern ransomware era.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nAt its peak, Locky was distributed by the massive Necurs botnet, utilizing unprecedented volumes of malspam. Emails typically contained weaponized Word documents with malicious macros, or ZIP files containing highly obfuscated JavaScript downloaders.\n\nLocky's technical execution is ruthlessly efficient:\n<ul>\n<li><strong>Aggressive File Encryption:</strong> Upon execution, Locky generates a unique RSA-2048 and AES-128 key pair. It rapidly scans all local drives and, critically, all accessible network shares (even unmapped ones), encrypting over 160 different file extensions. Encrypted files are renamed, famously appending the `.locky`, `.zepto`, or `.osiris` extension.</li>\n<li><strong>Shadow Copy Deletion:</strong> To prevent easy recovery, Locky executes `vssadmin.exe Delete Shadows /All /Quiet`, destroying all local Windows Volume Shadow Copies before the user realizes an attack is occurring.</li>\n<li><strong>Domain Generation Algorithm (DGA):</strong> Locky utilized a complex DGA to locate its Command and Control (C2) servers for key exchange. This made it highly resilient against simple DNS sinkholing or IP blocklists, as it could generate and attempt to contact thousands of new domains daily.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Locky infection is a catastrophic \"Code Red\" event. It results in immediate, widespread data loss and operational paralysis. Because it aggressively targets network shares, a single compromised workstation can encrypt the entire corporate file server infrastructure within minutes.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Total Network Severance (Pull the Plug):</strong> If active Locky encryption is detected, the absolute highest priority is to physically disconnect the infected machine(s) and take critical file servers offline immediately to halt the spread of the encryption across the SMB network.</li>\n<li><strong>Identify Patient Zero:</strong> Utilize EDR and firewall logs to identify the initial infected host and the delivery mechanism (usually an opened email attachment) to understand the breach vector.</li>\n<li><strong>Restore from Offline Backups:</strong> Do not pay the ransom. Locky remediation requires completely wiping all affected machines and file servers, rebuilding the OS, and restoring all data from secure, offline backups that were not connected to the network during the attack.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransom.Locky",
    "Win32/Locky",
    "Trojan-Ransom.Win32.Locky"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Locky?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ransomware, first seen in early 2016, that encrypts files on Windows systems and demands a ransom; it is no longer active."
      }
    },
    {
      "@type": "Question",
      "name": "How was Locky distributed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through exploit kits and malicious spam emails carrying malicious attachments or downloaders."
      }
    },
    {
      "@type": "Question",
      "name": "How did Locky tell victims they were infected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It displayed ransom-note instructions as both a desktop wallpaper and text files placed on the system."
      }
    },
    {
      "@type": "Question",
      "name": "Is Locky still a threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Per Malwarebytes, Locky is out of commission, though its history makes it a useful example of document/spam-based ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "How can document- and spam-based ransomware like Locky be prevented?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Disable Office macros from untrusted sources, be cautious with email attachments, keep software patched, and maintain offline backups."
      }
    },
    {
      "@type": "Question",
      "name": "Where can I read an authoritative source on Locky?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Malwarebytes maintains a Ransom.Locky detection page, linked on this page."
      }
    }
  ],
  "faq_count": 6,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T09:03:09Z",
  "sources": [
    {
      "name": "Malwarebytes: Ransom.Locky",
      "url": "https://www.malwarebytes.com/blog/detections/ransom-locky"
    }
  ],
  "type": "Ransomware",
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}