Locky Ransomware Installed Through Nuclear EK
Unit 42 reports Locky ransomware delivered through the Nuclear exploit kit using Flash exploits, adding a drive-by path to existing malspam distribution.
24
Malware
Nuclear EK
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
2 articles · newest firstAfraidgate: Major Exploit Kit Campaign Swaps Locky Ransomware for CryptXXX
Unit 42 reports the Afraidgate campaign switched from Nuclear EK delivering Locky to Angler EK delivering CryptXXX via the Bedep downloader.
38
Appears with
- Lockymalware · 2
- Palo Alto Networksvendor · 2
- Afraidgatethreat actor · 1
- Pseudo-Darkleechthreat actor · 1
- AutoFocusproduct · 1
- Wiresharkproduct · 1
- Unit 42organization · 1
- FreeDNSvendor · 1
- Proofpointorganization · 1
- Neutrino EKmalware · 1
- Bedepmalware · 1
- Angler EKmalware · 1
- CryptXXXmalware · 1
- WildFireproduct · 1
- Proofpointvendor · 1
- Palo Alto Networksorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.