Locky Malware Family: IOCs, Detection, MITRE ATT&CK, Response

Overview

Executive Summary

Locky is an extremely notorious, historically devastating strain of enterprise ransomware that first appeared in 2016. It was responsible for some of the most widespread and costly cyberattacks globally, notoriously shutting down hospitals and large corporations. While its prevalence has declined in favor of more modern targeted ransomware (like Conti or LockBit), its aggressive encryption algorithms, rapid network propagation capabilities, and sophisticated evasion techniques made it a defining threat of the modern ransomware era.

Infection Vector and Technical Capabilities

At its peak, Locky was distributed by the massive Necurs botnet, utilizing unprecedented volumes of malspam. Emails typically contained weaponized Word documents with malicious macros, or ZIP files containing highly obfuscated JavaScript downloaders. Locky's technical execution is ruthlessly efficient:

Aggressive File Encryption: Upon execution, Locky generates a unique RSA-2048 and AES-128 key pair. It rapidly scans all local drives and, critically, all accessible network shares (even unmapped ones), encrypting over 160 different file extensions. Encrypted files are renamed, famously appending the `.locky`, `.zepto`, or `.osiris` extension.
Shadow Copy Deletion: To prevent easy recovery, Locky executes `vssadmin.exe Delete Shadows /All /Quiet`, destroying all local Windows Volume Shadow Copies before the user realizes an attack is occurring.
Domain Generation Algorithm (DGA): Locky utilized a complex DGA to locate its Command and Control (C2) servers for key exchange. This made it highly resilient against simple DNS sinkholing or IP blocklists, as it could generate and attempt to contact thousands of new domains daily.

Threat Assessment

A Locky infection is a catastrophic "Code Red" event. It results in immediate, widespread data loss and operational paralysis. Because it aggressively targets network shares, a single compromised workstation can encrypt the entire corporate file server infrastructure within minutes.

Incident Response and Remediation

Total Network Severance (Pull the Plug): If active Locky encryption is detected, the absolute highest priority is to physically disconnect the infected machine(s) and take critical file servers offline immediately to halt the spread of the encryption across the SMB network.
Identify Patient Zero: Utilize EDR and firewall logs to identify the initial infected host and the delivery mechanism (usually an opened email attachment) to understand the breach vector.
Restore from Offline Backups: Do not pay the ransom. Locky remediation requires completely wiping all affected machines and file servers, rebuilding the OS, and restoring all data from secure, offline backups that were not connected to the network during the attack.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_LOCKY {
    meta:
        description = "Detects Locky (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "locky" ascii wide nocase
        $s2 = "ransom.locky" ascii wide nocase
        $s3 = "win32/locky" ascii wide nocase
        $s4 = "trojan-ransom.win32.locky" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Locky Activity
id: a270bb19c22d88bd2a4046f1c304db2c
status: experimental
description: Detects generic indicators of the locky malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*locky*"
            - "*ransom.locky*"
            - "*win32/locky*"
            - "*trojan-ransom.win32.locky*"
    condition: selection
level: medium

Frequently Asked Questions

What is Locky?

Ransomware, first seen in early 2016, that encrypts files on Windows systems and demands a ransom; it is no longer active.

How was Locky distributed?

Through exploit kits and malicious spam emails carrying malicious attachments or downloaders.

How did Locky tell victims they were infected?

It displayed ransom-note instructions as both a desktop wallpaper and text files placed on the system.

Is Locky still a threat?

Per Malwarebytes, Locky is out of commission, though its history makes it a useful example of document/spam-based ransomware.

How can document- and spam-based ransomware like Locky be prevented?

Disable Office macros from untrusted sources, be cautious with email attachments, keep software patched, and maintain offline backups.

Where can I read an authoritative source on Locky?

Malwarebytes maintains a Ransom.Locky detection page, linked on this page.

Locky

Overview

Executive Summary

Infection Vector and Technical Capabilities

Threat Assessment

Incident Response and Remediation

Known aliases

MITRE ATT&CK Techniques

Generated Detections (Boilerplate)

YARA Rule

Sigma Rule

References & External Analysis

Frequently Asked Questions

Related Families (Category: ransomware)

Machine-readable

Ecosystem & Interactive Environments