LokiLocker Ransomware Now Boasts Wiper Module

The LokiLocker ransomware is a relatively new arrival on the ransomware landscape. First spotted in the wild by security researchers in the summer of 2021, the malicious toolkit has been recently updated to include a disk wiper module.

The LokiLocker ransomware made headlines after it was examined again by a team with BlackBerry Threat Intelligence. The analysis pointed out that the dangerous tool now had added disk wiper functionality that allows it to irreversibly destroy data on compromised systems. The ransomware is not directly related to the older Locky ransomware.

Double extortion and wipers

Ransomware gangs have been using double and even triple extortion methods for almost two years now. The trend began sometime in late 2020 with ransomware outfits exfiltrating as much sensitive information from the target's systems as possible, then threatening to leak the information if the ransom is not paid. This tactic simply adds another incentive for paying the ransom, as the exfiltrated data may be of a particularly sensitive nature.

However, when you think of trying to hold data hostage and pressure the victim into paying the ransom, complete data destruction isn't something that seems like a good tool in the hands of the criminals. Why, then, are ransomware actors adding wiper modules to their tools?

The answer is still elusive, even to researchers, it seems. BlackBerry spotted a connection between the LokiLocker ransomware and an Iranian team of threat actors known as AccountCrack, but the connection is still tentative and there is no hard information where the ransomware's origins lie.

Less total attacks, still a significant threat

Ransomware has been steadily dropping in total number of attacks on a yearly basis, with fewer attacks in the first quarter of 2022 compared to 2021. Even though this trend might seem like a little victory, it has more to do with the way ransomware threat actors have begun to operate.

Instead of launching as many attacks as possible, bad actors now attempt to hone in on large, high-value targets that may potentially offer much bigger payouts. This seems to be the chief factor driving the total number of attacks down, and not some sudden change of heart on part of the criminals.