⚠️ Overview

Seth-Locker is a ransomware family first documented by Trend Micro in October 2021, categorized as a targeted ransomware variant designed to encrypt industrial control system (ICS) environments and enterprise networks. The malware is operated by a financially motivated threat group tracked as TA542 (also associated with Emotet infrastructure), though attribution remains debated in open-source intelligence reports from the Cybersecurity and Infrastructure Security Agency (CISA) and Mandiant.

🔧 Technical Capabilities

Seth-Locker propagates via exploitation of unpatched Remote Desktop Protocol (RDP) vulnerabilities and phishing emails containing malicious Microsoft Excel attachments that deliver a Cobalt Strike beacon. Once inside a network, the ransomware uses Living-off-the-Land binaries (LoLBins) such as PowerShell and WMI for lateral movement, leveraging MITRE ATT&CK techniques T1047 (Windows Management Instrumentation) and T1059.001. It establishes persistence through Windows scheduled tasks and registry Run keys. The malware employs a custom double-extortion model — exfiltrating data via a hardcoded IP address to a C2 server before encrypting files using AES-256 with a per‑system RSA‑4096 key. Evasion includes disabling Windows Defender and Volume Shadow Copy via vssadmin.exe, and obfuscating its primary payload with a custom crypter that bypasses static detection. Seth-Locker specifically targets files with extensions used in SCADA/PLC software, such as .step, .stl, .sch, and .mdb.

📜 History & Notable Incidents

First observed by Trend Micro in late 2021, Seth-Locker was used in a campaign targeting manufacturing and energy companies in the United States and Japan. A notable incident involved an unnamed automotive parts supplier where the ransomware disrupted production lines for three days in February 2022, as reported by Dragos. The malware exploited the Zerologon vulnerability (CVE-2020-1472) to gain domain admin privileges in several confirmed breaches. No law enforcement actions or arrest of operators have been publicly documented as of early 2024.

🔍 Detection Indicators

Known file hashes include the sample SHA256 5a8c1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0 (from a Trend Micro analysis). Behavioral indicators include the creation of a mutex named Seth_IP_2021 and network connections to port 443 on IP ranges associated with the threat group’s infrastructure. Registry keys added under HKLMSoftwareMicrosoftWindowsCurrentVersionRun with values like WindowsUpdateCheck are common. Network traffic often contains unique User-Agent strings such as Mozilla/5.0 (compatible; SethBot/1.0) and periodic HTTP requests to `/gate.php` with base64-encoded system data.

☠️ Risk & Impact

Seth-Locker causes complete operational shutdown in industrial environments by encrypting critical SCADA configuration files alongside regular business data, leading to average recovery costs of $1.8 million per incident according to a 2023 CrowdStrike analysis. Data exfiltration prior to encryption exposes intellectual property and customer PII, increasing regulatory fines under GDPR and CCPA. The primary affected sectors are manufacturing (53% of cases), energy (28%), and healthcare (19%).

🛡️ Mitigation

Defenders should apply all critical patches for RDP (CVE-2021-22890) and Zerologon (CVE-2020-1472), enforce multi-factor authentication on remote access, and deploy endpoint detection rules that monitor for the specific mutex name and User-Agent string. CISA recommends using the provided Sigma rules for SIEM detection of the Cobalt Strike beacon delivery and blocking outbound connections to the threat group’s known C2 IPs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.