Netskope Threat Labs

WastedLocker

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Description

WastedLocker is a ransomware family that researchers attribute to the Indrik Spider group, and its operators have used it since at least May 2020 against a broad variety of sectors, including manufacturing, information technology, and media.

Stats

First seen
April 2022
Last seen
October 2026

Also known as

Wastedlocker

MITRE ATT&CK techniques

20 techniques across 7 tactics.

TA0002 Execution

TA0003 Persistence

TA0004 Privilege Escalation

  • T1548Abuse Elevation Control Mechanism

TA0005 Stealth

TA0007 Discovery

  • T1012Query Registry
  • T1083File and Directory Discovery
  • T1120Peripheral Device Discovery
  • T1135Network Share Discovery

TA0040 Impact

  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery

TA0112 Defense Impairment

  • T1112Modify Registry
  • T1222File and Directory Permissions Modification

Associated groups

Alert name variants

Alert Name
Gen:Variant.Ransom.WastedLocker.1
Gen:Variant.Ransom.WastedLocker.29
Gen:Variant.Ransom.WastedLocker.4
Trojan.Ransom.WastedLocker.1
Trojan.Ransom.WastedLocker.A
Trojan.Ransom.WastedLocker.B
Win32.Ransomware.Wastedlocker
Win32.Ransomware.WastedLocker

Related IPS Signatures

Signature Name
MALWARE-OTHER Win.Ransomware.WastedLocker binary download attempt

Related families

InvisiMolePlugXDarkGateBitPaymerEmbargo

References