MorLock
MorLock is a threat actor referenced by Kaspersky as having significant similarities and overlaps with Crypt Ghouls and other groups targeting Russia, including BlackJack, Twelve, and Shedding Zmiy (aka ExCobalt). The reported overlap includes shared or similar tooling, utilities, file and folder naming conventions, and infrastructure, which Kaspersky said may indicate shared resources, collaboration, or shared knowledge and tooling, while also complicating attribution. Specifically, Kaspersky reported that Crypt Ghouls and MorLock used the same resocks utility, and that utilities seen across the overlapping campaigns included SoftPerfect Network Scanner, PingCastle, and XenAllPasswordPro. Based on the provided content, MorLock is associated with campaigns targeting Russia, but the content does not provide high-confidence standalone details on MorLock’s full victimology, intrusion chain, or whether it is a nation-state or cybercriminal actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
4 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a related ransomware intrusion cluster with overlapping tooling, naming conventions, and infrastructure with Crypt Ghouls, suggesting possible resource sharing or collaboration.
Referenced as a separate group conducting similar recent campaigns targeting Russia with overlapping tools/infrastructure; no additional details provided in the content.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.