AttackIQ Adds LokiLocker Ransomware Emulation to AEV Platform
Summary
AttackIQ released an AEV attack graph emulating LokiLocker behaviors, including persistence, defense evasion, shadow-copy deletion, discovery and file encryption, to help teams test security controls. It draws on BlackBerry reporting and internal analysis.
Key points
- AttackIQ's new attack graph emulates LokiLocker deployment behaviors on its Adversarial Exposure Validation platform to help customers assess security controls.
- The emulation covers persistence through scheduled tasks, Registry Run keys and the Windows Startup folder.
- Scenarios test defense evasion and recovery inhibition, including disabling Task Manager and Windows Firewall and deleting Volume Shadow Copies.
- Discovery scenarios use Windows APIs, Registry queries and WMI to collect system, CPU, drive and filesystem information.
- The article describes LokiLocker as a .NET ransomware-as-a-service active since at least August 2021; it says the malware uses AES-256-GCM for file encryption and RSA-2048 to protect keys.
- The article says LokiLocker can optionally wipe non-system files and overwrite the Master Boot Record; it does not say the emulation performs those actions.
Article Details
- Event Type
- AttackIQ released an attack emulation reproducing behaviors associated with LokiLocker ransomware.
- Impact
- The emulation lets security teams assess detection, prevention, and response controls against LokiLocker-associated behaviors, including persistence, disabling security controls, deleting shadow copies, system discovery, and file encryption. The article describes LokiLocker as capable of optionally wiping non-system files and overwriting the MBR; it does not report a new real-world compromise.
MITRE ATT&CK
T1012 · Query RegistryThe emulation queries the Registry for the MachineGUID.T1053.005 · Scheduled TaskThe emulation creates a scheduled task using schtasks for persistence.T1082 · System Information DiscoveryThe emulation uses Windows system-information APIs to collect system and logical-drive information.T1083 · File and Directory DiscoveryThe emulation uses FindFirstFileW and FindNextFileW to enumerate files and directories.T1105 · Ingress Tool TransferThe emulation downloads payloads to memory and saves them to disk to test delivery controls; this is described as an emulation scenario.T1112 · Modify RegistryThe emulation modifies registry values to disable Task Manager and to change Windows OEM information.T1120 · Peripheral Device DiscoveryThe emulation uses GetDriveTypeW to identify drive types.T1486 · Data Encrypted for ImpactThe emulation performs file encryption routines described as similar to those used by LokiLocker.T1490 · Inhibit System RecoveryThe emulation deletes Volume Shadow Copies using vssadmin.exe and wmic.exe to hinder recovery.T1497.001 · System ChecksThe emulation uses WMI to obtain CPU properties.T1547.001 · Registry Run Keys / Startup FolderThe emulation establishes persistence through Registry Run/RunOnce entries and files placed in the Windows Startup folder.T1562.004 · Disable or Modify System FirewallThe emulation uses netsh commands to disable Windows Firewall profiles and operational mode.