Loading story…
ESET reported that the TorrentLocker ransomware campaign expanded from Australia into the United Kingdom by sending spam emails that directed recipients to fake Royal Mail parcel-tracking pages. Those sites served a ZIP archive containing the malware to visitors with UK IP addresses, while users outside the UK were redirected to Google, indicating deliberate geographic targeting. Researchers identified three newly registered domains tied to the operation and said the campaign had begun only recently.
Once launched, TorrentLocker encrypted victims’ documents and demanded 350 GBP within 72 hours, rising to 700 GBP after the deadline, with payment required in Bitcoin through Tor-hosted infrastructure exposed via Tor2Web links. ESET said it traced payments from campaign-specific Bitcoin wallets to another wallet previously linked to scams including wallet theft and fake mining hardware sales, suggesting overlap with broader criminal activity. The company said its products detect the malware as Win32/Filecoder.NCC or Win32/Injector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ESET documented three newly registered domains hosting the fake Royal Mail pages and reported that the campaign had started very recently. The researchers also traced campaign Bitcoin wallets to another wallet previously linked to scams including wallet theft and fake mining hardware sales.
A TorrentLocker ransomware campaign began targeting UK users using spam emails themed as Royal Mail package-tracking notices. The operation used fake Royal Mail webpages that served a ZIP archive containing the malware only to visitors with UK IP addresses, while redirecting others to Google.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CryptoLocker** emerged as a highly disruptive ransomware operation that encrypted files with strong public-key cryptography, including data on local drives, removable media, and accessible network shares, then demanded roughly **$300/€300** in **Bitcoin** or MoneyPak for the private key. Victims were warned they had only about **72 hours** to pay before losing access permanently, and reports indicated that the malware’s encryption was generally not breakable, leaving organizations and consumers dependent on payment or unaffected backups. Security reporting also noted that some victims who paid did receive working decryption keys, while disruptions to command-and-control infrastructure sometimes prevented even paying victims from recovering files. The operators later added a **"second chance"** decryption portal that raised the price from **2 bitcoins** during the initial deadline to **10 bitcoins** after expiration, effectively turning the campaign into a more structured extortion service. Coverage linked the operation to the use of **Tor** and resilient backend infrastructure to conceal command systems and maintain contact with victims, while later reporting traced **millions of dollars in laundered Bitcoin** tied to the crimewave. The campaign underscored how ransomware actors were combining strong encryption, anonymous payment channels, and hidden services to industrialize file-encryption extortion at scale.
Jun 29, 2026
Proofpoint reported a sharp escalation in **Locky ransomware** distribution by threat actors associated with major **Dridex** operations, including a campaign that sent **tens of millions of emails** and heavily targeted organizations in the **UK and France**. The activity relied on malicious email attachments such as **JavaScript files**, weaponized documents, and archive-based lures, showing that established banking malware operators had moved aggressively into ransomware delivery at scale. Researchers said the campaigns used a newly identified downloader, **RockLoader**, alongside layered evasion tactics including heavily obfuscated JavaScript, junk files, malformed `Content-Type` headers, **RAR archives**, and misleading or double file extensions. Proofpoint also observed RockLoader delivering multiple payloads beyond Locky, including **Dridex 220**, **Pony**, and **Kegotip**, indicating a flexible malware distribution platform that was rapidly changing code and delivery methods to bypass detection and improve infection rates.
Jun 29, 2026
ESET reported that malware branded **"CryptoLocker 2.0"** is likely not a new version of the original CryptoLocker but a separate copycat ransomware family using the name for credibility and profit. The company said the threat, detected as `MSIL/Filecoder.D` and `MSIL/Filecoder.E`, still encrypts victim files with public-key cryptography and demands payment, but differs substantially from the original in its programming language, encryption workflow, command-and-control behavior, ransom process, and the types of files it targets. Unlike the original CryptoLocker, the newer strain was written in **C#**, targets a broader set of consumer media files, stores encrypted keys in separate `.k` files, and accepts ransom payments only in **Bitcoin**. Researchers said the malware also carries broader trojan functionality beyond file encryption. ESET observed samples masquerading as software cracks, spreading through removable media, stealing Bitcoin wallets, launching **BFGMiner**, and potentially supporting **DDoS** activity. The company warned that, despite being a copycat rather than the original operation, the malware can still cause serious damage to victims who lack reliable backups, and it urged users to maintain current backups and updated security protections.
Jun 29, 2026