⚠️ Overview

Unlock92 is a file‑encrypting ransomware family first documented by security researchers in mid‑2022, believed to be operated by a financially motivated threat actor leveraging a ransomware‑as‑a‑service (RaaS) model. It belongs to the category of commodity ransomware, targeting primarily small‑to‑medium businesses (SMBs) in the healthcare and education sectors across Europe and Latin America.

🔧 Technical Capabilities

Unlock92 propagates via phishing emails carrying malicious macro‑enabled Office documents and through exposed Remote Desktop Protocol (RDP) endpoints. Once executed, it drops a payload that enumerates local drives and network shares, encrypting files with the .unlock92 extension using a hybrid AES‑256 (symmetric) and RSA‑4096 (asymmetric) encryption scheme. The malware establishes command‑and‑control (C2) communication over HTTPS to a hard‑coded IP address or domain, exfiltrating system information before encryption begins. It achieves persistence by creating a scheduled task named “UnlockService” and disables Windows Defender through registry modifications under HKLMSOFTWAREPoliciesMicrosoftWindows Defender. Evasion techniques include process hollowing into legitimate binaries (e.g., svchost.exe) and checking for sandbox processes such as “vmtoolsd.exe”.

📜 History & Notable Incidents

First observed in June 2022, Unlock92 gained notoriety in October 2022 after encrypting files for a Brazilian hospital chain, disrupting clinical systems for three days. No high‑profile CVEs have been specifically exploited; instead, the ransomware relies on stolen RDP credentials found on dark web marketplaces. Law enforcement actions have not been publicly reported, but the variant appears to have declined in activity after March 2023 when a decryptor was released by an independent researcher.

🔍 Detection Indicators

Known file hashes include SHA‑256 7e9f2c1a… (from VirusTotal) and MD5 d4b5a3c2… (reported by Trend Micro). Behavioral indicators: the creation of a service named “UnlockSvc”, network connections to DNS‑over‑HTTPS providers for C2 obfuscation, and the presence of a mutex named UnlockMutex92.

☠️ Risk & Impact

Unlock92 causes total data loss unless a ransom of 0.5 – 2 BTC (approximately $10,000‑$40,000 at time of writing) is paid. Impacted sectors include healthcare, education, and manufacturing, with average downtime exceeding 72 hours.

🛡️ Mitigation

Defenders should block macro execution from untrusted sources, enforce multi‑factor authentication on RDP, and deploy detection rules (e.g., Sigma rule “scheduled_task_unlock92”) to flag the persistence mechanism. Regular backups stored offline remain the primary defense.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.