LockerGoga

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

LockerGoga is ransomware first reported in January 2019 that researchers tied to attacks on European industrial and manufacturing companies.

Stats

First seen: February 2022
Last seen: October 2026

Also known as

Lockergoga

MITRE ATT&CK techniques

7 techniques across 4 tactics.

TA0005 Stealth

T1070Indicator Removal
- T1070.004File Deletion

TA0008 Lateral Movement

T1570Lateral Tool Transfer

TA0040 Impact

T1486Data Encrypted for Impact
T1529System Shutdown/Reboot
T1531Account Access Removal

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing
T1685Disable or Modify Tools

Associated groups

G0037FIN6

Alert name variants

Alert Name	Engine
DeepScan:Generic.Ransom.LockerGoga.67BFD52E	AV
DeepScan:Generic.Ransom.LockerGoga.C8893F33	AV
Dump:Generic.Ransom.LockerGoga.67BFD52E	AV
Dump:Generic.Ransom.LockerGoga.C8893F33	AV
Gen:Variant.Ransom.LockerGoga.11	AV
Gen:Variant.Ransom.LockerGoga.12	AV
Generic.Ransom.LockerGoga.0BBE456C	AV
Generic.Ransom.LockerGoga.4223BE99	AV
Generic.Ransom.LockerGoga.CA4FC2EE	AV
Generic.Ransom.LockerGoga.CC1CD792	AV
Trojan.Ransom.LockerGoga.A	AV
Trojan.Ransom.LockerGoga.C	AV
Win32.Ransomware.LockerGoga	ATP Sandbox Adv. Heuristics
Win32.Trojan.Lockergoga	ATP Sandbox Adv. Heuristics
Win64.Ransomware.LockerGoga	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Ransomware.Lockergoga binary download attempt	IPS-SWG

Related blogs

Ransomware Bulletin: LockerGoga

Ransomware Bulletin: LockerGoga

May 13, 20195 min read

Related families

Qilin DarkGate HermeticWiper ShrinkLocker Black Basta

References