Trusted Design

Necurs Botnet Returns With Updated Locky Ransomware In Tow

概要

When the Necurs botnet went dark at the beginning of the month, so too did email campaigns bearing Locky ransomware and Dridex, prompting questions among observers about the reasons behind the pause and how long it would last. The second question now seems to be have an answer: on June 21, Proofpoint researchers observed the first multi-million message Locky email campaign since May 31st. On the evidence of reused IP addresses, this campaign appears to be originating from the Necurs botnet. As of the writing of this blog on June 22, a second, much larger Locky campaign was underway, signaling a clear return of both Locky and the Necurs botnet. Source : https://www.proofpoint.com/us/threat-insight/post/necurs-botnet-returns-with-updated-locky-ransomware-in-tow

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Without Necurs, Locky Struggles (score: 0.82)
• Necurs Botnet Malspam still pushing Locky ransomware (score: 0.75)
• Malware-Traffic-Analysis.net - 2017-10-02 - Necurs Botnet malspam sto;; pushing .ykcol" variant Locky ransomware (score: 0.71)
• Locky Ransomware Cybercriminals introduce New RockLoader Malware (score: 0.69)
• Malware-Traffic-Analysis.net - FTFY: Necurs Botnet malspam pushing .asasin" variant Locky ransomware (score: 0.67)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る