{
	"id": "0995d398-4361-435e-8e0e-297e91bab9ee",
	"created_at": "2026-04-06T00:07:10.41062Z",
	"updated_at": "2026-04-10T03:20:49.911959Z",
	"deleted_at": null,
	"sha1_hash": "2e9e59bb16ba751d7d7ce2eddf940d9d53979074",
	"title": "New Locky Ransomware Phishing Attacks Beat Machine Learning Tools",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 85513,
	"plain_text": "New Locky Ransomware Phishing Attacks Beat Machine Learning\r\nTools\r\nBy Jai Vijayan\r\nPublished: 2017-09-28 · Archived: 2026-04-05 18:35:15 UTC\r\nThe Locky ransomware strain, initially spotted in February 2016, has emerged as one of the most dangerous\r\nexamples of the highly persistent and pernicious nature of modern cyber extortion campaigns.\r\nThe operators of the malware—among the most prolific ransomware samples ever—have shown a tendency to\r\nlaunch brief waves of attacks, go dormant for some time and then come back with a vengeance to torment\r\nbusinesses and consumers.\r\nThe most recent of those waves happened in late September and appeared targeted at businesses in multiple\r\nregions including North America, Europe and Southeast Asia, security vendor Comodo said in a soon-to-be-published special report.\r\nComodo described the September Locky campaign as building on two previous attack waves that the vendor\r\nreported on last month (here \u0026 here). As with the earlier attacks, the latest ones too used a botnet of zombie\r\ncomputers distributed around the word to send highly convincing looking phishing emails to potential victims.\r\nOne of the emails used in the phishing campaign was designed to appear like a scanned document from a business\r\nprinter located at the victim's organization. To lend credibility, the phishing email included a model number for a\r\nvery popular Konica Minolta scanner/printer widely deployed in businesses around the world.\r\nA second email used in the phishing campaign was spoofed to appear like a query pertaining to the status of a\r\nvendor invoice. Recipients, who were lured into opening the attachments in these emails, downloaded Locky on\r\ntheir systems. The average ransom amount for the decryption key tended to range between $2,000 and $4,000.\r\nThe social engineering that was used to engage victims was carefully designed to slip past malware detection tools\r\nincluding those using machine-learning algorithms to spot phishing emails, says Fatih Orhan, vice president,\r\nthreat labs at Comodo.\r\nThe attachment in one of the emails for instance was disguised as a printer output, and it contained a script inside\r\nan archive file. \"This is not enough to make a phishing detection,\" Orhan says.\r\n\"Machine learning algorithms need to extract the attachment, open the archive, extract the script and understand it\r\nhas a malicious intent,\" he notes. \"Usually, these scripts contain just a download component and do not have\r\nmalicious intent on their own. That’s why even machine learning is not sufficient in making these kinds of\r\ndetections.\"\r\nAdditional measures are needed to run the script dynamically and to download the actual payload, and conduct\r\nmalware analysis to detect phishing, Orhan explains.\r\nhttps://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010\r\nPage 1 of 3\n\nSecurity researchers at Comodo detected and analyzed over 110,000 Locky-related emails at customer endpoints\r\nover a three-day period between Sept. 17 and Sept. 20.\r\nThe phishing emails that purported to be printer output were sent from a total of nearly 120,000 IP addresses from\r\n139 country code top-level domains, according to Comodo. The other phishing email that was utilized in the\r\nSeptember Locky campaign was sent from over 12,350 IP addresses in 142 countries. In total, the IP addresses\r\nused in the September attacks were scattered across more than half of all countries in the world.\r\nMany of the IP addresses belonged to infected computers belonging to individual consumers. But there were a fair\r\nnumber of systems belonging to ISPs as well, Orhan says.\r\nSignificantly, a considerable number of servers used to spread the phishing email were the same as ones used in\r\nprevious campaigns. \"These are mostly compromised servers as we understand,\" Orhan said. \"The fact that they\r\nare used for multiple attacks shows there is no remediation on these servers.\"\r\nMany ISPs also do not appear to have controls for spotting infected systems belonging to their customers that are\r\nbeing used to continuously send phishing emails over weeks.  \"It's possible they don’t have real-time detection\r\ncapabilities. But the attacks being continuous over weeks, shows they are incompetent in securing the network\r\ntraffic they are providing,\" Orhan says.\r\nLocky was one of the most widely distributed ransomware tools in 2016 and looks set to be among the most\r\nwidely distributed pieces of malware this year as well. One of its most notable victims—at least publicly disclosed\r\nones—is Hollywood Presbyterian Medical Center, which was forced to pay $17,000 to retrieve a critical database\r\nthat was encrypted with the malware.\r\nNews about the latest Locky attacks comes even as Europol this week warned of ransomware eclipsing all other\r\nforms of cyber threat for the second year in a row.\r\n\"Ransomware attacks have eclipsed most other global cybercrime threats, with the first half of 2017 witnessing\r\nransomware attacks on a scale previously unseen following the emergence of self-propagating ‘ransomworms,' \"\r\nEuropol said citing examples like WannaCry and Petya/NotPetya outbreaks.\r\nRelated content:\r\nJoin Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most\r\nknowledgeable IT security experts. Check out the INsecurity agenda here.\r\nAbout the Author\r\nhttps://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010\r\nPage 2 of 3\n\nContributing Writer\r\nJai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was\r\nmost recently a Senior Editor at Computerworld, where he covered information security and data privacy issues\r\nfor the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other\r\ntechnology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to\r\nComputerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's\r\ndegree in Statistics and lives in Naperville, Ill.\r\nSource: https://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010\r\nhttps://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.darkreading.com/attacks-breaches/new-locky-ransomware-phishing-attacks-beat-machine-learning-tools/d/d-id/1330010"
	],
	"report_names": [
		"1330010"
	],
	"threat_actors": [],
	"ts_created_at": 1775434030,
	"ts_updated_at": 1775791249,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2e9e59bb16ba751d7d7ce2eddf940d9d53979074.pdf",
		"text": "https://archive.orkl.eu/2e9e59bb16ba751d7d7ce2eddf940d9d53979074.txt",
		"img": "https://archive.orkl.eu/2e9e59bb16ba751d7d7ce2eddf940d9d53979074.jpg"
	}
}