Locky

Last reviewed: September 9, 2026

Locky is a type of ransomware that first emerged in 2016. It encrypts files on an infected system and demands a ransom payment in Bitcoin for the decryption key. Locky primarily targets Windows operating systems and has been distributed through various methods, including malicious email attachments and exploit kits. As of October 2023, Locky is no longer as prevalent as it once was, but it remains a notable example of ransomware due to its widespread impact and the techniques it employed.

Overview

Locky is a ransomware family that encrypts files on a victim's computer, rendering them inaccessible. The malware then demands a ransom payment, typically in Bitcoin, to provide the decryption key necessary to restore the files. Locky was first identified in February 2016 and quickly gained notoriety for its rapid spread and the significant financial impact it had on victims. The ransomware primarily targets Windows operating systems and has been distributed through various methods, including malicious email attachments and exploit kits.

History

Locky was first discovered in February 2016 and quickly became one of the most prevalent ransomware threats. It was initially distributed through email campaigns that used malicious Microsoft Word documents containing macros. When the document was opened and macros were enabled, the malware would download and execute the Locky payload. Over time, Locky's distribution methods evolved to include exploit kits and other forms of social engineering.

Locky experienced several waves of activity, with new variants and distribution methods emerging periodically. The ransomware was particularly active throughout 2016 and 2017, during which it was responsible for numerous high-profile infections. However, its activity declined in subsequent years as law enforcement and cybersecurity efforts improved, and newer ransomware families emerged.

Technical characteristics

Locky is known for its ability to encrypt a wide range of file types, making it particularly disruptive to victims. Upon infection, Locky scans the system for files to encrypt, targeting documents, images, videos, and other commonly used file types. The ransomware uses a combination of RSA and AES encryption algorithms to secure the files, making decryption without the key extremely difficult.

Locky also employs various techniques to evade detection and analysis. It can disable system restore points, making it more challenging for victims to recover their files without paying the ransom. Additionally, Locky often uses command and control (C2) servers to communicate with its operators, allowing them to manage the infection and collect ransom payments.

Infection vector

Locky has been distributed through several methods, with email campaigns being the most common. These campaigns typically involve phishing emails containing malicious attachments, such as Microsoft Word documents with embedded macros. When the recipient opens the document and enables macros, the Locky payload is downloaded and executed.

In addition to email campaigns, Locky has also been spread through exploit kits, which are tools used by cybercriminals to exploit vulnerabilities in software and deliver malware. These kits often target outdated or unpatched software, making it crucial for users to keep their systems updated to reduce the risk of infection.

Notable campaigns

Locky was involved in several high-profile campaigns during its peak activity. One of the most notable occurred in early 2016, when the ransomware was distributed through a massive email campaign that targeted hospitals and healthcare organizations. This campaign resulted in significant disruptions to medical services and highlighted the potential impact of ransomware on critical infrastructure.

Another significant campaign took place in late 2016, when Locky was distributed through the Neutrino exploit kit. This campaign targeted a wide range of industries and resulted in numerous infections worldwide. The use of exploit kits marked a shift in Locky's distribution strategy and demonstrated the adaptability of its operators.

Detection and mitigation

Detecting and mitigating Locky infections requires a combination of technical measures and user awareness. Antivirus and anti-malware software can help detect and block Locky before it can encrypt files. Additionally, email filtering solutions can help prevent malicious emails from reaching users' inboxes.

User education is also crucial in preventing Locky infections. Users should be trained to recognize phishing emails and avoid opening suspicious attachments or enabling macros in documents from unknown sources. Regularly updating software and applying security patches can also help reduce the risk of exploitation by Locky and other malware.

In the event of a Locky infection, it is important to isolate the affected system to prevent the ransomware from spreading to other devices on the network. Victims should also report the incident to law enforcement and seek assistance from cybersecurity professionals to determine the course of action.

Locky Ransomware Timeline

Locky Infection Process

Sources

Categories: Malware

Last updated: September 9, 2026