Locky Ransomware Returns yet Again Thanks to the Necurs Botnet

Even though a lot of people had hoped Locky ransomware would finally disappear into obscurity, it appears we are not so lucky after all. In fact, researchers indicate the malware is making a rather surprising return, thanks to the Necurs botnet. A new dedicated spam campaign is underway to bring this ransomware to as many people as possible.

The Return of Locky Ransomware (Again)

It appears certain types of malware are incredibly difficult to weed out altogether. Whereas some types of ransomware are popular for a few weeks or months and then disappear, there are always exceptions. Locky ransomware, one of the most destructive types of malware, is back once again. This time, its developers are trying to spread this malicious software through the Necurs botnet, which has proven to be quite effective in its own right.

It has been quite some time since researchers came across Locky ransomware for the last time. In fact, it appears 2017 would be spent without having to worry about this threat ever again. Sadly, the harsh reality sets in, as a new spam email campaign has been discovered which is actively distributing the Locky payload to victims all over the world. It is also apparent this campaign uses similar techniques to some of the more successful Dridex banking trojan campaigns.

One silver lining is how the Locky payload itself has not undergone any notable changes. Successful ransomware developers often release updated versions of their creations, which include new features to avoid detection or force users to pay a bitcoin ransom. So far, that does not appear to be the case with Locky, which is some relief. However, with the methodology of distribution changing, the threat should not be ignored by any means.

As one would somewhat expect, criminals now distribute this malware through PDF files, which require the victim to download and open the email attachment. There are two different email variants being sent out right now, one of which contains text, whereas the other one is blank. Every email is linked to a “Payment” or “Receipt” subject line, which validates the email attachment in question. The PDF file has an embedded Word document which contains the payload.

Although it remains unclear whether or not this campaign heralds a new wave of Locky distribution, security researchers are concerned about this development. That is not entirely surprising since the notorious malware impacts various hospitals and other major organizations over the past few years. Malware-laden Word documents are becoming the favorite tool among cybercriminals when it comes to distributing malicious software, that much is evident.

The Necurs botnet has been used successfully in distributing the Dridex banking Trojan over the past few months. Now that criminals are using the same strategy for ransomware, it is impossible to tell how things will evolve moving forward. Now is a good time to be even more cautious than ever when it comes to opening emails from unknown senders. The Necurs botnet has been widely appreciated by criminals as of late, as it has been used for pump-and-dump stock plays, work-from-home scams, and even Russian dating advertisements.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.


  1. zortilonrel January 20, 2021
  2. Idcash88 slot bola online February 10, 2021
  3. February 11, 2021
  4. scrapbook para iniciantes February 13, 2021
  5. impressões em Guarulhos February 13, 2021
  6. Caleb's Auto Detailing February 14, 2021
  7. Gesso February 14, 2021
  8. Judi Online February 14, 2021
  9. bolsa termica para colica February 15, 2021
  10. gym shop February 15, 2021
  11. this link February 16, 2021
  12. TS911 February 16, 2021
  13. 192.168.l.3 February 16, 2021
  14. smartsolar s200 February 17, 2021
  15. filmes online hd February 18, 2021
  16. Names for Free Fire February 18, 2021
  17. Animes Online February 18, 2021
  18. adsl hız testi February 19, 2021
  19. Rabattcode February 19, 2021
  20. Best online deals February 19, 2021
  21. e-commerce February 20, 2021
  22. pc repair February 21, 2021
  23. der reisen February 21, 2021
  24. jovens de sucesso February 21, 2021
  25. igreja February 21, 2021
  26. mpo slot February 21, 2021
  27. Bandar judi online February 22, 2021
  28. pauschalreisen February 22, 2021
  29. Alma vacation ownership February 22, 2021
  30. Market speculation February 23, 2021
  31. Dow trends February 23, 2021
  32. learn english February 23, 2021
  33. see February 23, 2021
  34. 2020 ghana music February 23, 2021
  35. maplestory February 24, 2021
  36. wordpress elementor 2021 February 24, 2021
  37. best wordpress hosting February 24, 2021
  38. learn wordpress 2021 February 24, 2021
  39. solar malaysia February 25, 2021
  40. banda para eventos sp February 26, 2021
  41. Loose Leaf Tea March 2, 2021
  42. Mysore taxi services March 2, 2021
  43. knowledge base software March 3, 2021
  44. Biquíni Girassol March 4, 2021
  45. Ilha Grande March 4, 2021
  46. unique bathroom vanities March 4, 2021
  47. eletricista Cascais March 5, 2021
  48. mudra barra da tijuca March 5, 2021
  49. carimbos March 6, 2021
  50. แทงหวย March 6, 2021
  51. joker March 7, 2021
  52. Joker123 March 7, 2021
  53. Situs Vivoslot Online March 7, 2021

Leave a Reply