LockerGoga
Software · ATTACK:ics:S0372
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:S0372",
"title": "LockerGoga",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0372",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--5af7a825-2d9f-400d-931a-e00eb9e27f48",
"external_id": "S0372",
"domain": "ics",
"created": "2019-04-16T19:00:49.435Z",
"modified": "2026-05-12T15:12:00.733Z",
"version": "2.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CarbonBlack LockerGoga 2019",
"url": "https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/"
},
{
"source_name": "Unit42 LockerGoga 2019",
"url": "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S0372 → uses → ATTACK:ics:T0828
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46bc86e4-e20b-4778-80d2-8891039e6fb4
Hydro · Kevin BeaumontATTACK:ics:S0372 → uses → ATTACK:ics:T1695.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58edd7e0-7b54-4ac5-8e84-81e2dfb03a71
LockerGoga Revisited · Kevin Beaumont · Detecting LockerGogaATTACK:ics:S0372 → uses → ATTACK:ics:T0829
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7a55fc66-0d5c-4ef6-af28-d4a4bb84381d
Hydro · Kevin BeaumontATTACK:ics:S0372 → uses → ATTACK:ics:T1695.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5b4b91c-0f68-4b88-bd6f-ab226ae9b5f0
LockerGoga Revisited · Kevin Beaumont · Detecting LockerGogaATTACK:ics:G0037 → uses → ATTACK:ics:S0372
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad7770c3-fe24-4285-9ce2-1616a1061472
FireEye FIN6 Apr 2019ATTACK:ics:S0372 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5ab26e2-eb90-4f19-b35a-b8a0a5438961
Hydro · Kevin Beaumont