Threat Actor Profile: Blue Locker Ransomware
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
Blue Locker Ransomware, first detected in late 2021, the group stayed low-profile for years before making global headlines in August 2025 with a targeted attack on Pakistan Petroleum Limited (PPL), the country’s second-largest oil and gas producer.
The attack encrypted servers, wiped backups, and brought financial operations to a standstill for two days, prompting Pakistan’s National CERT to issue an emergency advisory to 39 government ministries and institutions.
However, attribution remains vague due to competing analyses linking the malware to the Iranian-associated Proton ransomware family on one hand and to an open-source project called MemeCryptor on the other.
Threat Actor card for Blue Locker
Who is Blue Locker?
Blue Locker first appeared in the wild around November 2021 and Microsoft added the detection signature Ransom:Win32/BlueLocker.MK!MTB on December 1, 2021, while backup-security vendor Elastio recorded a first-seen date of November 1, 2021. By early 2022, ReversingLabs observed the .blue family circulating in samples and published a YARA detection rule for it. At that stage, little was known about the operators. The group had “little known cybercriminal ties” and no specific ransom amount was published in the notes.
The group was quiet for three years before escalating dramatically in August 2025. The attack on Pakistan Petroleum Limited brought Blue Locker into the spotlight again.
The attribution puzzle
Understanding who is behind Blue Locker requires navigating two competing analytical threads:
Lineage chart for Blue Locker Ransomware
Thread 1: The Proton family lineage
- Resecurity assessed Blue Locker as “a variant of the Proton ransomware family, sharing similarities with previous strains including Limba, Zola, and Shinra.”
- Proton was first observed in March 2023 (Acronis dates its debut to that month; Fortinet’s earliest sample is from late March 2023).
- The Israeli National Cyber Directorate (INCD) published a Shinra Malware Profile in October 2024 stating the malware “was part of the Proton ransomware family, which has been known to operate since early 2023 with probable Iranian origins.”
- Fortinet’s FortiGuard Labs reached a similar assessment.
The Proton family is not structured as a traditional Ransomware-as-a-Service (RaaS) with open affiliate recruitment. It operates as a closed group. Its lineage includes Shinra (first submitted to public scanners in April 2024), Limba (targeting Chinese-speaking victims), Zola (emerged May 2024, with a Persian-keyboard kill switch that avoids encrypting systems with Farsi input enabled), Cipher, and Trust.
Proton has also been linked to the Loki Locker / BlackBit family and shows code overlap with the older Fonix ransomware.
Thread 2: The MemeCryptor codebase
Independent malware researcher rivitna (Andrey Zhdanov) classifies the exact same .blue / “Bule Cryptor” / restore_file.txt artifacts under the name “BlueLocker (MemeCryptor).”
MemeCryptor is an open-source ransomware project published on GitHub by user “DarkFunct,” explicitly described as “inspired by Conti.” It uses multithreaded ChaCha20 encryption with XOR-wrapped RSA keys and supports hiding keys through BMP steganography.
These two threads are not necessarily contradictory. Proton source code has been sold on the dark web, and the MemeCryptor codebase is publicly available. The same operators could be drawing from both. Or separate actors could be reusing the “Blue Locker” brand and .blue extension independently. The public record has not resolved this.
False flags and obfuscation
The Blue Locker binary contains Chinese-language strings, including “ZhuDongFangYu” (a reference to a Qihoo 360 security component) and an XOR-encoded reference to “Chrome.exe” that renders as Chinese characters when viewed raw. These are treated as deliberate false flags planted to misdirect attribution away from the actual operators. They are not assessed as evidence of Chinese origin.
Chinese-language strings from Blue Locker binary (Source)
The presence of Chinese-character strings in Blue Locker’s code is noteworthy but not sufficient for attribution on its own. Additionally, codebase shows strong lineage ties to the Proton ransomware family, with possible Iranian origins or Dark Web source code transfers.
The Pakistan-China strategic relationship also complicates the picture: China is Pakistan’s largest arms supplier, its primary infrastructure investor through CPEC, and its closest diplomatic partner, making a state-sponsored Chinese operation against Pakistani critical infrastructure strategically implausible, though non-state cybercriminal actors can operate independently of geopolitical alignments.
The Chinese artifacts are equally consistent with deliberate false-flagging, residual code inherited through source transfers, or an incidental Unicode mapping produced by the XOR key.
Name collision warning
Analysts working on Blue Locker need to be aware of a significant naming overlap. At least three distinct malware artifacts share the .blue extension or a variation of the “Blue” name:
- Blue Locker / MemeCryptor: appends .blue, drops restore_file.txt, contains “Blue Cryptor” strings.
- Proton / Shinra V2: also appends .blue, but renames files to random 10-character strings and uses different note names (#Restore-files.txt, #HowToRecover.txt). Different artifact set.
- Phobos “Blue”: an unrelated Phobos-family variant. Entirely separate codebase and operator.
Conflating these will contaminate your intelligence. Always validate against the specific IOCs and artifact patterns, not just the extension.
What are Blue Locker’s Targets?
Blue Locker has one confirmed, publicly named victim: Pakistan Petroleum Limited (PPL), attacked on August 6, 2025. PPL is Pakistan’s second-largest oil and gas producer, responsible for roughly one-fifth of the country’s total natural gas supply. The attackers encrypted servers and virtual machines, deleted backups, and suspended financial operations for two days. They claimed to have exfiltrated approximately 1 TB of data, though PPL denied that sensitive data was compromised.
NCERT spokesman Imran Haider stated that “some other organizations were also attacked,” but none have been publicly named. NCERT described its deployed defenses as detecting and blocking the malware at those sites, suggesting attempted rather than fully successful compromises. Separately, NCERT distributed a critical advisory to 39 government ministries and institutions (including the Cabinet Division, FIA, OGRA, FBR, and PEMRA, among others). These were warning recipients, not confirmed victims.
Vendors’ analysis references “confirmed victims across Pakistan and various parts of Asia” in the technology, government services, and oil and gas sectors, but names none beyond PPL. Vendor characterizations similarly list technology-sector targeting without citing specific incidents.
Blue Locker does not operate a public data-leak site. It negotiates via private ProtonMail, Jabber, and Tox channels, which means additional victims could exist without any public disclosure.
Based on the PPL attack alone, the operators showed clear understanding of virtualized infrastructure, backup architecture, and the operational leverage created by hitting financial systems. But generalizing a target profile from a single confirmed incident carries obvious limits.
How Does Blue Locker Attack?
Blue Locker follows a double-extortion model. The operators steal data before encrypting, then threaten to leak it if the ransom is not paid. The PPL incident is the most documented example of the full attack chain.
Reconnaissance and Initial Access
Blue Locker operators use several common initial access vectors. Reporting identify phishing emails with malicious attachments or links as the primary delivery mechanism. The group also exploits insecure remote access configurations, drive-by downloads, trojanized software, and unsafe file-sharing platforms.
Once a foothold is established, a PowerShell-based loader is deployed. This loader handles defense disabling, privilege escalation, and payload delivery. The use of PowerShell is consistent with the MITRE ATT&CK technique T1059.001, though NCERT mapped to T1059.003 for this campaign.
The malware can also propagate across local networks and removable media, extending the reach of a single initial compromise.
Privilege Escalation and Defense Evasion
After initial access, Blue Locker escalates privileges through a UAC bypass via registry manipulation (MITRE ATT&CK T1548.002). The malware modifies registry keys to elevate its execution context without triggering the standard User Account Control prompt.
In parallel, the operators work to disable or impair security tools on the compromised host (T1562.001). The malware also employs several evasion techniques:
- String obfuscation and deobfuscation (T1140): Key strings in the binary, including file paths and tool names, are XOR-encoded. The “Chrome.exe” string, for example, is stored as Chinese characters and decoded at runtime.
- Timestomping (T1070.006): File timestamps are manipulated to complicate forensic timeline reconstruction.
- Virtualization and sandbox evasion (T1497): The malware checks for analysis environments.
Persistence
Blue Locker establishes persistence by writing itself into the Windows Registry Run keys (HKLMSOFTWAREMicrosoftWindows NTCurrentVersionRun), ensuring it re-executes after every reboot (T1547.001).
The MemeCryptor source code shows the payload copies itself to %Temp% under a randomly generated filename and registers under SOFTWAREMicrosoftWindowsCurrentVersionRun, using a mutex derived from the string wbizecif48njqgpprzkm6769 to prevent duplicate execution.
Discovery and Credential Theft
Once running with elevated privileges, the malware performs account discovery (T1087), process discovery (T1057), file and directory discovery (T1083), and registry queries (T1012) to map the environment and identify high-value targets for encryption and exfiltration.
A notable technique involves the Chrome browser process. Chrome locks its local password database while running, so the malware forcibly terminates chrome.exe to bypass the file lock, then encrypts the password files to render them inaccessible to the victim. The process name is stored as XOR-encoded Chinese characters and decoded at runtime. The goal is to maximize damage by locking the victim out of their saved passwords alongside everything else.
Data Collection and Exfiltration
Before triggering encryption, the operators stage and exfiltrate data to support their double-extortion leverage.
Additionally, in the PPL attack, the operators’ extortion email claimed they had stolen business data and employee information, including TMC data and contracts. Separately, a Dark Web actor using the handle “yyy32111” published a post, claiming to possess approximately 1 TB of PPL data, though it was claimed as likely false or part of a psychological operation.
Anti-Recovery and Encryption
When the operators are ready to execute the final stage, Blue Locker destroys recovery options and encrypts the environment.
Shadow copy deletion: The malware executes wmic SHADOWCOPY DELETE (T1490) to remove all Windows Volume Shadow Copies, eliminating the most common quick-recovery path for Windows systems.
Service termination: Critical services are stopped (T1489) to unlock files held by running applications and maximize the scope of encryption.
Encryption: The malware uses a hybrid cryptographic scheme. RSA is used as the asymmetric wrapper, and a symmetric cipher handles bulk file encryption.
The exact symmetric cipher varies across samples. Vendor reporting and the NCERT advisory describe AES+RSA, while the MemeCryptor source code implements ChaCha20+RSA.
A ransom note named restore_file.txt (and in some variants, HOW_TO_BACK_FILES.html) is dropped. The note opens with “[ Hello! ]” and is signed “BY BLUE LOCKER“.
Extortion and Negotiation
Blue Locker ransom note
Blue Locker uses a double-extortion model. The operators threaten both permanent data loss (from encryption) and public exposure (from the stolen data).
The ransom note warns victims that continued inaction will lead the operators to “report the hack to mainstream media and release your data to social media and competitors.” No fixed ransom amount is published. Instead, the note instructs victims to “contact us with a quote,” forcing them into a negotiation.
Communication channels are ProtonMail, Jabber, and a TOX ID. The use of ProtonMail and TOX rather than a dedicated Tor-based negotiation portal is notable. The absence of a dedicated Tor-based leak site appears to be a deliberate choice rather than a gap in capability, given the maturity of the rest of their operation and this decision also strengthens the possibility of the actors’ ties with a nation-state.
Data leak claims have been made through dark web forum posts rather than a branded Tor portal.
Conclusion
Blue Locker sits at an uncomfortable intersection of open-source code, dark-web source transfers, and probable nation-state involvement.
The PPL attack proved the operators can cause real operational damage to critical infrastructure, and the timing near Pakistan’s Independence Day, the false-flag Chinese strings, and the Proton family’s probable Iranian origins all point toward something more deliberate than opportunistic cybercrime.
At the same time, the public record is thin: one confirmed victim, competing attribution threads that no analyst has fully reconciled, and a set of network indicators that are single-sourced and partly invalid.
Blue Locker is worth tracking not because of what it has done so far, but because the combination of capable tooling, double-extortion tradecraft, and state-aligned targeting patterns suggests the PPL attack was a proof of concept rather than a one-off.
Organizations in Pakistan’s energy, government, and technology sectors should treat the NCERT advisory as a standing warning
Indicators of Compromise (IOCs) for Blue Locker
File Hashes (SHA-256)
| SHA-256 |
|---|
| d3cc6cc4538d57f2d1f8a9d46a3e8be73ed849f7fe37d1d969c0377cf1d0fadc |
| e6bd4ed287d1336206f5b4b65011e570267418799eb60c2d0d7496d5d9e95a33 |
| 6eeb20cc709a18bf8845f7b678967b7f0ff96475cf51a261da87244886bbfd2e |
| 515bd71a8b3c2bce7b40b89ddfe2e94d332b0779d569c58117f8dcdcb8a91ed9 |
Additional Hashes (from NCERT Advisory NCA-38)
| Hash | Type | Artifact |
|---|---|---|
| 6af349a30f95e01b87cd7dd4ddc8e3fe | MD5 | Dropper |
| 7e1cc4d2e4b35b95d6e4cba6c21e4b6f7f2783d1 | SHA-1 | Encrypter stub |
Communication / Negotiation
| Channel | Identifier |
|---|---|
| ProtonMail | [email protected] |
| Jabber (XMPP) | [email protected] |
Host-Based Indicators
| Indicator | Type |
|---|---|
| .blue file extension (also .bulock16 in older variants) | File modification |
| restore_file.txt | Ransom note |
| wmic SHADOWCOPY DELETE | Command execution |
| [ Hello! ] | Ransom note header |
| Registry Run key creation under CurrentVersionRun | Persistence |
Network Indicators (from NCERT Advisory NCA-38)
Malicious Domains:
| Domain | Function |
|---|---|
| shinra-encrypt-support.xyz | Ransom portal |
| blue-decryptor.site | Key negotiation |
| locker-c2.onion | TOR C2 server |
| backup-leaks.fun | Exfiltration archive |
Malicious IPs:
185.225.69.140
195.3.145.99
91.243.113.21
103.150.199.23
185.180.197.34
45.155.205.233
84.54.52.83
185.212.128.88
176.123.2.209
89.44.9.210
185.140.53.227
149.202.82.172
103.86.177.19MITRE ATT&CK TTPs of Blue Locker
| Tactic | Technique ID | Technique Name |
|---|---|---|
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
| Persistence / Privilege Escalation | T1543 | Create or Modify System Process |
| Privilege Escalation | T1548.002 | Abuse Elevation Control Mechanism: Bypass User Account Control |
| Defense Evasion | T1140 | Deobfuscate/Decode Files or Information |
| Defense Evasion | T1070.006 | Indicator Removal: Timestomp |
| Defense Evasion | T1562.001 | Impair Defenses: Disable or Modify Tools (ATT&CK v16.1) (T1685 – Disable or Modify Tools) |
| Discovery | T1012 | Query Registry |
| Discovery | T1057 | Process Discovery |
| Discovery | T1087 | Account Discovery |
| Discovery | T1083 | File and Directory Discovery |
| Discovery | T1497 | Virtualization/Sandbox Evasion |
| Collection | T1074 | Data Staged |
| Impact | T1490 | Inhibit System Recovery |
| Impact | T1489 | Service Stop |
| Impact | T1486 | Data Encrypted for Impact |
Article Link: https://socradar.io/blog/dark-web-profile-blue-locker-ransomware/