{"id":8794,"date":"2017-08-17T14:40:01","date_gmt":"2017-08-17T22:40:01","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/08\/17\/news-2567\/"},"modified":"2017-08-17T14:40:01","modified_gmt":"2017-08-17T22:40:01","slug":"news-2567","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/08\/17\/news-2567\/","title":{"rendered":"Locky Launches a More Massive Spam Campaign with New \u201cLukitus\u201d Variant"},"content":{"rendered":"

Credit to Author: Joie Salvio, Rommel Joven and Floser Bacurio| Date: Thu, 17 Aug 2017 21:37:00 +0000<\/strong><\/p>\n

\n

\"\"<\/p>\n

It has just been a week since the variation of Locky named Diablo6<\/a> appeared. Now it has launched another campaign more massive than the previous. This time, it uses “.lukitus”, which means “locking” in Finnish, as the extension for the encrypted files. The FortiGuard Lion Team was the first to discover this variant with the help of Fortinet’s advanced  Kadena Threat Intelligence System <\/em>(KTIS) (1)<\/p>\n

\"\"<\/p>\n

Fig. 1 Encrypted files with .lukitus extension<\/em><\/p>\n

\"\"<\/h1>\n

Fig. 2 Familiar Locky ransom note<\/em><\/p>\n

Same Locky, More Spam<\/h3>\n

This new campaign has launched over four times the number of email samples, we have collected from different sources, compared to the previously discovered .diablo6 campaign.<\/p>\n

\"\"<\/p>\n

Fig. 3 Spam campaign emails of .lukitus variant<\/em><\/p>\n

This campaign uses the following email subjects and attachment names:<\/p>\n

 <\/div>\n