LockerGoga
Software · ATTACK:enterprise:S0372
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0372",
"title": "LockerGoga",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0372",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
"external_id": "S0372",
"domain": "enterprise",
"created": "2019-04-16T19:00:49.435Z",
"modified": "2026-05-12T15:12:00.733Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CarbonBlack LockerGoga 2019",
"url": "https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/"
},
{
"source_name": "Unit42 LockerGoga 2019",
"url": "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20904798-df45-48a6-8428-9e4fb913f6ae
CarbonBlack LockerGoga 2019ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31daba72-fb27-45a9-9224-991032b605a8
CarbonBlack LockerGoga 2019 · Unit42 LockerGoga 2019 · Wired Lockergoga 2019ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1529
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c7bb2a4-eede-4dae-ac41-03782729a961
Wired Lockergoga 2019ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1531
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57385cb2-e3ef-4006-b465-a5a48632d02b
CarbonBlack LockerGoga 2019 · Unit42 LockerGoga 2019ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76a951cd-cb2c-485a-9596-b0df6302ba41
Wired Lockergoga 2019ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0372
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad7770c3-fe24-4285-9ce2-1616a1061472
FireEye FIN6 Apr 2019ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c035989f-a86f-4746-a9d4-3286dc68e473
Wired Lockergoga 2019ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d80bbf0c-2fb4-4272-a878-65662452d3ca
Unit42 LockerGoga 2019