Description Summary
'MalasLocker'; active only April–May 2023 (~170 victims) then DORMANT for years. Unusual demand: donate to charity rather than pay. Treat as historic/defunct.
Threat Actor
'MalasLocker'; charity-donation demand model; inactive for years.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
Not publicly reported
Ransom Note Name
Not publicly reported
Targeted Industries
Professional services, Manufacturing, Technology
First Seen
April 2023
Last Seen
DORMANT since May 2023
Geographical Location
Global
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |