Which threat actors have used Locky Ransomware?

How Locky Was Operated by More Than One Threat Actor

Locky was a ransomware family rather than a single-operator campaign, so the useful question is not “who owned it” but “which financially motivated crews used it and how did they deliver it.” In practice, it appeared in spam runs, malicious attachments, and phishing-led infection chains that handed encryption to whoever controlled the campaign at the time.

That matters because attribution changes less than defence. If a ransomware family is widely reused, the defenders’ job is to recognise the delivery pattern, stop initial access, and assume the same playbook can be repackaged by other crews. The family name tells you the malware style; it does not reliably identify one enduring actor.

What Threat-Actor Attribution Usually Looks Like for Locky

Locky was most often linked to cybercriminal operators running mass-distribution infrastructure, not to a single fixed group identity. The same codebase could be pushed through different spam waves, brokered access, or affiliate-like arrangements, which is why public reporting often describes the operators as financially motivated threat actors rather than a named, exclusive team.

For a practitioner, the important distinction is between malware family attribution and campaign attribution. Malware families can persist across many operators, while the delivery infrastructure, email lures, and monetisation model often tell you more about the actor than the ransomware name itself. That is why current guidance tends to emphasise behaviour and delivery chain over the label.

Locky-era reporting also fits the broader ransomware pattern seen in Ransomware Groups Guide, where affiliates, brokers, and reused tooling make single-actor attribution unreliable. When a family is distributed through spam and malicious attachments, multiple crews can operationalise the same payload with little change to the end result.

How Defenders Should Read the Campaign Pattern

The practical value of actor attribution here is in mapping the campaign, not in naming a mastermind. If the initial access path is email-based, the security signal is attachment handling, macro abuse, user execution, and the speed from message delivery to encryption. Those are the repeatable controls that matter across different operators using the same ransomware.

In that sense, Locky is best treated as a ransomware delivery pattern with interchangeable actors behind it. Defender attention should stay on the first stage of compromise, because once the attachment is opened and code runs, the operator identity is much less important than the fact that encryption and extortion can begin immediately.

For broader threat-actor context, Threat Actor Groups Guide helps separate group naming from malware naming, which is often necessary when a family is reused by multiple criminal crews. That distinction keeps incident response focused on infrastructure, access path, and behaviour rather than on assuming a one-to-one actor-to-malware relationship.

Risk and Threat Considerations

Locky’s threat value came from scale and reuse, not from a unique technical signature. When a ransomware family spreads through spam campaigns and malicious attachments, one campaign can reach many victims before defenders build reliable filters or detonation rules, and the same delivery model can be reused by different financially motivated operators.

Failure mechanism: Phishing or spam delivers the attachment, user execution or macro enablement starts the payload, and the ransomware encrypts files before the environment can detect the behaviour chain. Reused infrastructure and interchangeable operators make campaign attribution slow and reduce the value of trying to identify a single fixed threat group.

Impact: The result is loss of file availability, business interruption, and extortion pressure, with the added risk that defenders may focus too narrowly on attribution instead of stopping the delivery and execution path. Response quality improves when teams assume the same family can arrive through different actor infrastructures over time.

Practitioner Guidance

What to prioritise: Treat email ingress, attachment detonation, and macro control as the first containment layer. If the campaign reaches endpoints, behaviour monitoring should be tuned for rapid encryption activity, suspicious child processes, and abnormal file modification patterns rather than waiting for a named actor to be confirmed.

What to verify: Confirm whether any mailbox, gateway, or endpoint logs show the delivery chain before encryption started. If you can reconstruct the message, attachment, and execution sequence, you have a more actionable response record than a tentative attribution label.

Practitioner takeaway: With Locky, the defender’s highest-value decision is to recognise a reusable ransomware delivery pattern early, because campaign mechanics are more actionable than trying to pin the malware to one permanent threat actor.

Related resources from NHI Mgmt Group

• What does AI model abuse reveal about the current NHI threat surface?
• What are effective practices for operationalizing NHI threat detection?
• Why do secrets stay dangerous even when they are no longer actively used?
• How should security teams harden macOS endpoints against trojanized admin tools used by threat actors?