WastedLocker

Summary

WastedLocker is a ransomware strain primarily used in targeted attacks against large organizations. It encrypts files on infected systems, demanding a ransom payment in cryptocurrency to restore access. First identified in 2019, WastedLocker is associated with the threat actor group Evil Corp and is known for its sophisticated evasion techniques and selective targeting to maximize impact and ransom payouts.

Key Characteristics

• Targets enterprise environments, often focusing on high-value victims such as manufacturing, finance, and technology sectors.
• Utilizes advanced evasion methods to bypass antivirus and endpoint detection systems.
• Encrypts files with strong cryptographic algorithms, rendering data inaccessible without the decryption key.
• Employs manual deployment by attackers, often following initial access through phishing or exploitation of vulnerabilities.
• Demands ransom payments in Bitcoin or other cryptocurrencies, typically accompanied by threats to leak stolen data if demands are not met.
• Associated with Evil Corp, a cybercriminal group known for sophisticated malware campaigns and financial crime.

Defensive Controls

• Implement multi-factor authentication and strong password policies to reduce initial access risks.
• Maintain up-to-date endpoint protection solutions with behavioral detection capabilities.
• Regularly apply security patches and updates to software and operating systems to mitigate vulnerabilities.
• Conduct frequent data backups stored offline or in isolated environments to enable recovery without paying ransom.
• Educate employees on phishing awareness and safe email practices to prevent social engineering attacks.
• Monitor network traffic and system logs for unusual activity indicative of ransomware deployment or lateral movement.

Related Security Solutions

Endpoint Detection and Response (EDR) tools, advanced threat protection platforms, network intrusion detection systems (NIDS), secure backup solutions, and security information and event management (SIEM) systems are commonly employed to detect, prevent, and respond to WastedLocker ransomware attacks. Additionally, threat intelligence services provide timely information on emerging variants and attacker tactics.