Locker creator regrets and distributes decryption keys for free – It seems that cybercriminals can be heartless too. The creator of the Locker ransomware seems to have regretted his actions, after publishing the decryption keys for all his victims after his creation was successfully attacked. However, the ransom money he managed to collect during his “sleeper” campaign has not yet been returned to its predecessors.
[ You can refer to our previous article to learn more about Locker ransomware ]
Locker ransomware and the sleeper campaign
Last week, another ransomware, which was already installed on infected PCs, was activated. The ransomware called “Locker” is the operative tool of the “sleeper” campaign, according to the characterization given to it by the security company KnowBe4. It was named this way because its basic action plan is: when the creator of LOCKER “wakes up” and gives the command, the malware activates and encrypts the storage media of the infected PCs. In exchange for unlocking the infected computers, Locker asks each victim for about $24 in bitcoins.
A few days ago, a user claiming to be the creator of Locker publicly apologized for this campaign and revealed the decryption keys for all devices infected by Locker.
What the alleged creator said on PasteBin:
I am the creator of the LOCKER ransomware and I am very sorry for what happened. I did not intend to release the program. I uploaded a database to mega.co.nz that contains records of the format 'bitcoin address, public key, private key', as CSV. This is a dump of the entire database and most of the keys were not even used. The distribution of new keys has stopped.
The malware noted that an automatic decryption process for all infected devices will begin in early June. However, in his post, he makes no mention of compensating users who have already paid the ransom in bitcoins.
According to the company KnowBe4, hundreds of users have reported falling victim to LOCKER. An analyst at the company states that a campaign like this requires careful planning over several months and doubts that it was started by accident, as the alleged creator claims.
