Loading malware…
WastedLocker is a targeted Windows ransomware family first observed in 2020 and widely attributed with high confidence to the Evil Corp cybercriminal group. It emerged as part of Evil Corp’s operational shift away from earlier tooling such as Dridex and BitPaymer and has been associated with intrusions against large organizations, particularly in North America and especially the United States, across sectors including manufacturing, utilities and energy, professional services, transportation and logistics, retail, engineering, and life sciences.
WastedLocker is typically deployed late in the intrusion lifecycle after attackers obtain initial access and conduct internal reconnaissance. Observed delivery chains include the SocGholish fake-update framework, which has been used to deliver JavaScript-based loaders that profile victim systems and then deploy follow-on tooling such as Cobalt Strike. Operators have used that access for lateral movement and for identifying high-value systems including file servers, databases, virtualized infrastructure, cloud-connected assets, and backup-related systems before ransomware deployment.
Technically, WastedLocker is protected by a custom crypter known as CryptOne, which uses anti-analysis and staged decryption logic before launching the final payload. The ransomware can attempt privilege escalation through a UAC bypass when not already running with administrative rights. It has also been observed using alternate data streams and DLL hijacking as part of its elevation and execution chain. During execution, it can modify Windows registry settings associated with Internet ZoneMap behavior, apparently to improve access to remote resources, and it enumerates removable, fixed, shared, and remote drives for encryption.
WastedLocker supports selective encryption behavior and can prioritize specified directories, encrypt only chosen paths, or operate through a service-based execution mode. It identifies accessible network-adjacent drives and shared resources, excludes certain directories and file types, and encrypts large files in blocks. File encryption uses a per-file AES-256-CBC key and IV, with that key material protected by an embedded RSA-4096 public key. For each encrypted file, the malware appends a victim-specific wasted-style extension and creates a separate ransom-note or metadata file. It also deletes shadow copies and can install itself as a service to continue execution with elevated privileges.
WastedLocker is generally characterized as post-intrusion ransomware rather than opportunistic mass-distributed ransomware. Public reporting has consistently linked it to Evil Corp, and later ransomware such as Hades has been described as a variant derived from WastedLocker with additional obfuscation and minor feature changes. Available reporting indicates WastedLocker operations focused primarily on encryption and operational disruption rather than the large-scale public leak extortion model adopted by some other ransomware groups.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
WastedLocker is a new ransomware locker we’ve detected being used since May 2020.
WastedLocker — A ransomware family that has been used against a variety of targets worldwide.
"...shifted to using ransomware variants such as WastedLocker..."
31 distinct techniques documented for this family, organized by ATT&CK tactic.
WastedLocker attackers have also been observed using legitimate Windows utilities such as Windows Management Instrumentation [WMI] and PsExec to do this as well
Additional tools are used to manipulate the file system and suppress any requests for user input and/or confirmation. For example, choice.exe is leveraged to set file attributes as well as delete files. | PowerShell and WMIC are also sometimes utilized in profiling and tuning the environment.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks before using cmd.exe or Powershell.exe to connect to a command and control server to retrieve any secondary payloads for deployment.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks before using cmd.exe or Powershell.exe to connect to a command and control server to retrieve any secondary payloads for deployment.
The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.
These attacks uses sophisticated social engineering lures to convince target user to download and run malware, including ransomware and RATs.
When a user interacts with this content, a ZIP archive containing a heavily obsfuscated HTA or JS file is downloaded to their system. The file is then executed when the user opens the ZIP archive.
WastedLocker attackers have also been observed using legitimate Windows utilities such as Windows Management Instrumentation [WMI] and PsExec to do this as well
Denis exploits a security vulnerability to load a fake DLL and execute its code. Empire contains modules that can discover and exploit various DLL hijacking opportunities. PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
The script converts the decrypted payload (a base64-encoded string) to bytes and allocates memory before executing it.
Create and run a service . The service is deleted once the encryption process is completed.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Hades ransomware is a 64-bit compiled variant of WastedLocker upgraded with supplementary code obfuscation and a few minor feature changes.
The script converts the decrypted payload (a base64-encoded string) to bytes and allocates memory before executing it.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
This process allows for the ransomware to copy itself into the file by way of an alternate data stream (ADS). | MITRE ATT&CK Hide Artifacts: Hidden Files and Directories T1564
The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.
Anchor has used NTFS to hide files. APT32 used NTFS alternate data streams to hide their payloads. Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.
Denis exploits a security vulnerability to load a fake DLL and execute its code. Empire contains modules that can discover and exploit various DLL hijacking opportunities. PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.
facilitate the identification of additional systems on which attackers can deploy their main payloads
Once executed, the HTA or JS file acts as a preliminary loader, collecting system information and performing anti-analysis checks...
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
53 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
86 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware family explicitly linked in the content as associated with SocGholish activity.
Ransomware operation attributed in the article to Evil Corp.
A ransomware family deployed in post-SocGholish intrusion activity and explicitly attributed in the content to EvilCorp.
WastedLocker is a ransomware family described as a downstream payload/customer relationship tied to SocGholish access sales.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.