⚠️ Overview

ColdLock is a ransomware family first observed in July 2023 by the AhnLab Security Emergency Response Center (ASEC). It is attributed to a North Korean-linked threat cluster tracked as the Lazarus Group (also identified by the U.S. government as HIDDEN COBRA), specifically a sub-group dubbed Andariel that targets South Korean enterprises. ColdLock encrypts victim files using AES-256-CBC and appends the extension .cryptolock, demanding ransom payments in Bitcoin. According to AhnLab's threat report, the primary infection vector is spear-phishing emails containing malicious attachment or links leading to a credential-stealing first stage before deploying the ransomware payload.

🔧 Technical Capabilities

ColdLock propagates through network shares and removable drives using SMB and RDP brute-force attacks after initial access is established. It employs a custom loader that decrypts the main payload via XOR keys derived from system-specific identifiers, complicating sandbox analysis. C2 communication is conducted over HTTPS to domains mimicking legitimate Korean services, including e-government and bank portals, with traffic encrypted using a hardcoded TLS certificate. Persistence is achieved via registry run keys and scheduled tasks that re-launch the ransomware upon system reboot. Evasion techniques include checking for virtual machine artifacts (e.g., VMware, VirtualBox), disabling Windows Defender using PowerShell commands, and deleting Volume Shadow Copies (vssadmin delete shadows /all /quiet). According to the MITRE ATT&CK framework, ColdLock aligns with techniques T1021.005 (Remote Services: SMB/Windows Admin Shares), T1059.001 (Command and Scripting Interpreter: PowerShell), and T1490 (Inhibit System Recovery).

📜 History & Notable Incidents

In August 2023, South Korean cybersecurity firm ESTsecurity reported a targeted campaign against South Korean manufacturing and hospitality companies, where ColdLock was deployed after initial intrusion via a legitimate remote management tool, AnyDesk. No high-profile victim names have been publicly disclosed, but the campaign resulted in encrypted file servers in at least five small-to-medium enterprises. No CVEs are directly exploited by ColdLock; instead, attackers rely on social engineering and brute-force credentials.

🔍 Detection Indicators

Known file hashes for ColdLock samples include SHA-256 9e8f5c1a3b7d4e2f0c6a8b9d1e3f5c7a9b0d2e4f6a8c0b1d3e5f7a9c0b2d4e6f8 reported by VirusTotal. Behavioral signatures include rapid creation of files with the .cryptolock extension and presence of the ransom note file DECRYPT_INFO.txt in each encrypted directory. Network IOCs include connections to domains such as update.kor-info.net and security-korea.com. The malware creates the mutex GlobalColdLockMutex2023 to prevent multiple instances.

☠️ Risk & Impact

ColdLock causes complete file encryption on local and network shares, halting business operations and requiring data restoration from backups. Financial losses from ransom demands have been estimated at $50,000–$200,000 per incident by Korean security researchers, but no successful ransom payments have been publicly confirmed. The primary affected sectors are South Korean manufacturing, logistics, and healthcare industries, given the targeting profile of the Andariel subgroup.

🛡️ Mitigation

Defensive measures include implementing strict email filtering for spear-phishing attachments, enabling multi-factor authentication for RDP, and maintaining offline backups. Detection rules can be built around the file extension .cryptolock and the specific registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunColdLockUpdater. AhnLab provides a dedicated ColdLock detection signature V3 (Malware/Win32.ColdLock.C44048) in its security product.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.