MITRE ATT&CKsoftware (malware)
S0612 WastedLocker
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2021-05-20
Description
WastedLocker is a ransomware family attributed to Indrik Spider that has been used since at least May 2020. WastedLocker has been used against a broad variety of sectors, including manufacturing, information technology, and media.
Related
Uses · MITRE ATT&CK (20)
- T1027.016 Junk Code Insertion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1564.004 NTFS File Attributes sub-technique
- T1574.001 DLL sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1222.001 Windows Permissions sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1543.003 Windows Service sub-technique
- T1490 Inhibit System Recovery technique
- T1486 Data Encrypted for Impact technique
- T1135 Network Share Discovery technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1012 Query Registry technique
- T1083 File and Directory Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
- T1120 Peripheral Device Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0119 Indrik Spider group
References
- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ NCC Group WastedLocker June 2020
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us Symantec WastedLocker June 2020
- https://www.sentinelone.com/labs/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/ Sentinel Labs WastedLocker July 2020