Ghostlocker | Netskope Threat Labs

Description

GhostLocker is a ransomware operation linked to the GhostSec group, which researchers reported as offering its encryptor under a ransomware as a service model in 2023.

Stats

First seen: November 2023
Last seen: October 2026

Also known as

GhostLocker

Alert name variants

Alert Name	Engine
Win64.Ransomware.Ghostlocker	ATP Sandbox Adv. Heuristics
Win64.Ransomware.GhostLocker	ATP Sandbox Adv. Heuristics
Win64.Trojan.Ghostlocker	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Ransomware.GhostLocker variant outbound connection attempt	IPS-SWG
MALWARE-OTHER Win.Ransomware.GhostLocker variant download attempt	IPS-SWG

References

malpedia.caad.fkie.fraunhofer.de