Description
VHDLocker is a ransomware family that abuses Windows virtual hard disk attachment features to lock volumes without strong encryption. It maps virtual disks and changes their state to render data unavailable, and researchers noted that its weak implementation sometimes allowed recovery, which reflects its reliance on low effort extortion.
Stats
- First seen
- May 2023
- Last seen
- October 2026
Also known as
Vhdlocker
Alert name variants
| Alert Name |
|---|
| Win32.Ransomware.Vhdlocker |
| Win32.Ransomware.VHDLocker |