--- title: Emulating the Systematic LokiLocker Ransomware | daily.dev description: LokiLocker is a .NET-based Ransomware-as-a-Service active since mid-2021 targeting Windows systems. It encrypts files using AES-256 in GCM mode and protects... canonical: https://daily.dev/posts/emulating-the-systematic-lokilocker-ransomware-bqzb9sbqk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Emulating the Systematic LokiLocker Ransomware | daily.dev og:description: LokiLocker is a .NET-based Ransomware-as-a-Service active since mid-2021 targeting Windows systems. It encrypts files using AES-256 in GCM mode and protects... og:url: https://daily.dev/posts/emulating-the-systematic-lokilocker-ransomware-bqzb9sbqk og:image: https://api.daily.dev/og/posts/bQzb9sbqk.png og:image:alt: Emulating the Systematic LokiLocker Ransomware og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Emulating the Systematic LokiLocker Ransomware **[Security Boulevard](https://daily.dev/sources/securityboulevard)** · 6 min read · 0 upvotes · 0 comments ## Summary LokiLocker is a .NET-based Ransomware-as-a-Service active since mid-2021 targeting Windows systems. It encrypts files using AES-256 in GCM mode and protects keys with RSA-2048, while also deleting Volume Shadow Copies, disabling Task Manager and Windows Firewall, and optionally wiping the MBR. AttackIQ has released an attack graph emulating LokiLocker's TTPs across three stages: initial access and persistence (scheduled tasks, registry run keys, startup folder), defense evasion and backup removal (disabling security controls, deleting shadow copies), and discovery and encryption (system profiling via native APIs and WMI, filesystem enumeration, file encryption). Security teams can use this emulation in the AttackIQ AEV platform to validate detection and prevention controls against this threat. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [VolkLocker Ransomware Exposed by Hard-Coded Master Key Allowing Free Decryption](https://daily.dev/posts/volklocker-ransomware-exposed-by-hard-coded-master-key-allowing-free-decryption-aygv5ybyh) · The Hacker News · 1 upvotes · 1 comments - [New GenieLocker ransomware for Windows, ESXi, and Linux](https://daily.dev/posts/new-genielocker-ransomware-for-windows-esxi-and-linux-udjwdxd4t) · Securelist · 0 upvotes · 0 comments - [Everest Ransomware](https://daily.dev/posts/everest-ransomware-adnxkdwxy) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/emulating-the-systematic-lokilocker-ransomware-bqzb9sbqk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Emulating the Systematic LokiLocker Ransomware","url":"https://daily.dev/posts/emulating-the-systematic-lokilocker-ransomware-bqzb9sbqk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/emulating-the-systematic-lokilocker-ransomware-bqzb9sbqk"},"datePublished":"2026-02-26T19:36:53.810Z","dateModified":"2026-02-26T19:37:22.328Z","description":"LokiLocker is a .NET-based Ransomware-as-a-Service active since mid-2021 targeting Windows systems. It encrypts files using AES-256 in GCM mode and protects...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc48b4b7a6de7e97c6328c0345389ce0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/bc48b4b7a6de7e97c6328c0345389ce0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Security Boulevard","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Security Boulevard","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3613c832180040de8d85bb29f74395be","url":"https://daily.dev/sources/securityboulevard"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/emulating-the-systematic-lokilocker-ransomware-bqzb9sbqk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,ransomware","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Boulevard","item":"https://daily.dev/sources/securityboulevard"},{"@type":"ListItem","position":3,"name":"Emulating the Systematic LokiLocker Ransomware"}]} ```