A version of AstraLocker, AstraLocker 2.0 ransomware, has just been released. This updated version is what some threat analysts call a rapid attack, or smash-and-grab style of ransomware. The AstraLocker 2.0 developers use Microsoft Word attachments in emails to distribute their malicious payload using VBA macros. The user needs to click on the attachment and then click on an icon in the document for the OLE object in the payload to be activated. Double-clicking the icon causes a security warning to appear, and the user is then asked to run a file, WordDocumentDOC.exe.

The payload that is delivered directly via the email attachment is different, in that it cuts out traditional threat actor processes that are designed to evade detection by modern email security scanning tools and other triggers that alert the security operation center. Hence, AstraLocker 2.0 just wants to make a hard and immediate hit on anything they can immediately access, versus the studied and patient methodologies used by most ransomware attackers.

AstraLocker 2.0 attempts to disable anti-malware protections and EDR software. It will also kill any other processes running that can impact the successful encryption of data. Like all modern ransomware attacks, AstraLocker 2.0 deletes shadow copies and thereby jeopardizes your ability to recover.

To avoid becoming hostage to AstraLocker or other types of ransomware and malware, it is crucial to maintain recent offline backups of your most important files and data. Adopt a ‘defense-in-depth’ approach where you use layers of defense with several mitigations at each layer; this means you will have more opportunities to detect malware, and then stop it before it causes detrimental harm to your business.

If you want to learn more about how to best prepare and protect your business from ransomware and other threats, check out our blog, Reduce the Risk of Ransomware & Other Cyber Attacks.

Latest Ransomware Related Blogs

Incident Response Readiness. The image shows a man sitting at a desk, visibly stressed, with his hands on his head. He is staring at two computer monitors displaying warning messages that read "SYSTEM HACKED," suggesting that his computer system has been compromised. The room appears to be an office setting, with a light background and organized desk supplies. The man seems overwhelmed, likely due to the cyberattack that has disrupted his work.
Canva image. The image shows a close-up of a document labeled "Impact Analysis" with the phrase "Work products to be modified" underneath. A sharpened pencil is positioned diagonally on the document, emphasizing the text. The image suggests an analysis or evaluation process, with the pencil symbolizing planning or marking important points. The context appears to involve reviewing or modifying work processes or products based on the impact analysis findings.
Mitigating DoppelPaymer ransomware effects. The image depicts a person typing on a keyboard, with a digital overlay of cybersecurity elements. There is a semi-transparent shield icon with a padlock in the center, symbolizing security, and other icons related to data protection and technology around it. On the right side, there’s a digital login form interface, showing fields for a username and password. The overall theme of the image appears to be related to cybersecurity and secure online access. The person in the image is wearing a blue shirt, though their face is not visible.
LockBit ransomware recovery. The image shows a digital graphic with a dark background, featuring layers of translucent blue and green warning symbols (triangles with exclamation marks). These symbols appear to overlap with each other, suggesting multiple alerts or warnings. Behind the warning icons, there are binary code sequences (ones and zeros) scattered across the image, giving it a techy, cybersecurity-related vibe. The colors range from shades of blue to red, adding to the impression of a data or security breach alert.
ransomware resources
Contact Alvaka