Loading story…
Researchers reported that TeslaCrypt 2.0 was being distributed while posing as CryptoWall, a tactic that blurred attribution and complicated incident response for victims and defenders. The malware used CryptoWall-themed ransom messaging and presentation while retaining TeslaCrypt functionality, indicating that operators were deliberately leveraging the better-known ransomware brand to increase credibility and pressure victims into paying.
The campaign highlighted how ransomware groups were already adapting both their code and social engineering to improve payment rates and evade straightforward identification. For defenders, the overlap in branding and behavior underscored the need to rely on technical indicators and malware analysis rather than ransom-note labels alone when classifying infections, assessing impact, and selecting containment and recovery actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published research describing TeslaCrypt 2.0 being disguised as CryptoWall, indicating a technical development in how the ransomware was presented to victims.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that malware branded **"CryptoLocker 2.0"** is likely not a new version of the original CryptoLocker but a separate copycat ransomware family using the name for credibility and profit. The company said the threat, detected as `MSIL/Filecoder.D` and `MSIL/Filecoder.E`, still encrypts victim files with public-key cryptography and demands payment, but differs substantially from the original in its programming language, encryption workflow, command-and-control behavior, ransom process, and the types of files it targets. Unlike the original CryptoLocker, the newer strain was written in **C#**, targets a broader set of consumer media files, stores encrypted keys in separate `.k` files, and accepts ransom payments only in **Bitcoin**. Researchers said the malware also carries broader trojan functionality beyond file encryption. ESET observed samples masquerading as software cracks, spreading through removable media, stealing Bitcoin wallets, launching **BFGMiner**, and potentially supporting **DDoS** activity. The company warned that, despite being a copycat rather than the original operation, the malware can still cause serious damage to victims who lack reliable backups, and it urged users to maintain current backups and updated security protections.
Jun 29, 2026
A surge in sophisticated cyberattacks has been observed, with threat actors employing a variety of tactics to compromise organizations and individuals. Notable incidents include the use of the BYOVD (Bring Your Own Vulnerable Driver) technique to deploy DeadLock ransomware, as well as targeted campaigns leveraging phishing emails with HR-related lures to distribute Remcos RAT malware. Additionally, attackers are exploiting popular movie torrents to spread Agent Tesla via layered PowerShell scripts, and Android users in Spain are being targeted by the DroidLock ransomware, which can hijack devices and demand ransom through full-screen overlays. These campaigns demonstrate a trend toward multi-stage infection chains, abuse of legitimate tools and drivers, and the use of social engineering to increase the likelihood of successful compromise. Other significant developments include the targeting of Canadian organizations by the STAC6565/Gold Blade group using QWCrypt ransomware, and the emergence of new threat actor tactics such as disabling endpoint detection and response (EDR) systems to facilitate ransomware deployment. The threat landscape is further complicated by the activities of groups like Scattered Lapsus$ Hunters, who use social engineering and typosquatted domains to compromise Zendesk users, and the exposure of internal dynamics within ransomware groups like BlackBasta, revealing operational stress and internal mistrust. These incidents underscore the evolving nature of cyber threats, the blending of espionage and financial motives, and the increasing sophistication of both technical and social attack vectors.
Jun 29, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026