LokiLocker, a relatively new form of ransomware, uses the standard extortion-through-encryption racket but also incorporates disk-wiper functionality. Double extortion became a hit last year when ransomware gangs started stealing files before encrypting them to threaten victims with a sensitive data leak if they didn't pay up. BlackBerry Threat Intelligence is now warning that LokiLock, first seen in August 2021, now features an "optional wiper functionality" to put pressure on victims in a slightly different way. Instead of attackers using the threat of leaking a victim's files to pressure them into paying, LokiLock's customers threaten to overwrite a victim's Windows Master Boot Record (MBR), which wipes all files and renders the machine unusable. But that tactic effectively ends all negotiations about payment, of course. Disk-wiper functionality has come into focus recently because of destructive malware attacks on Ukrainian organizations. The US government fears destructive malware could target organizations in the West in retribution for sanctions against Russia. Historically, disk-wiper malware has often been favored by state-sponsored hackers, as was the case in NotPetya, WhisperGate, and HermeticWiper – all directly or loosely connected to Russian state-sponsored actors – where ransomware is a decoy for the true destructive intent. But commercially motivated ransomware that destroys the victim's computer? It certainly appears to be a different style of ransom negotiation than ransomware linked to Russian actors. "With a single stroke, everyone loses," BlackBerry notes. However, Microsoft has been tracking emerging – presumed state-backed or affiliated – Iranian hacking groups that are employing both encryption and destructive malware. BlackBerry points to some evidence that suggests LokiLocker was developed by Iranian hackers and designed to target English-speaking victims. The evidence: there are very few English spelling errors in the malware's debugging strings; LokiLocker affiliates are chatting on Iranian hacking forums, and Iran is the only location currently blacklisted for activating encryption. Additionally, some credential-cracking tools distributed in early samples of LokiLocker "seem to be developed by an Iranian cracking team called AccountCrack". "Although we've been unable to reliably assess exactly where the LokiLocker RaaS originates, it is worth mentioning that all the embedded debugging strings are in English, and – unlike the majority of malware originating from Russia and China – the language is largely free of mistakes and misspellings," BlackBerry notes. "It's not entirely clear whether this means they truly originate from Iran or that the real threat actors are trying to cast the blame on Iranian attackers," it said. It's common for Russia-based ransomware gangs to not activate malware on machines within Commonwealth of Independent States nations – often configured by blacklisting specific language codes within a machine's language settings. But BlackBerry says LokiLocker appears to be in beta. The Iran blacklist functionality hasn't been implemented. As for the disk-wiper functionality, BlackBerry says the malware will attempt to destroy a system if a ransom isn't paid within the specified timeframe. It deletes all of a victim's files, except for system files, and also tries to overwrite the MBR and then, after forcing a Blue Screen of Death error message, reboots the wiped machine and displays the message: "You did not pay us. So we deleted all of your files : ) Loki locker ransomware_". For more visit OUR FORUM.

When immersive experiences first became accessible to everyday consumers in the form of headsets like the Oculus Rift and Google Glass, the industry appeared ripe for mainstream acceptance. A few years later, the hype around VR and AR has died down. Then Facebook (the company) changed its name to Meta and signaled its investment in the metaverse. Suddenly everyone cared about VR and AR again. Yet I still find many people still aren’t quite clear on what all these terms mean. What’s the difference between augmented reality and virtual reality? What does ‘XR’ stand for, and what exactly is ‘mixed’ reality? Fret no more friends, I’m here to help. I should note that some of these terms are constantly evolving and that sometimes academic/technical/corporate usage differs from colloquial usage (we’re primarily focused on the latter here), but this guide should help you make sense of our imminent immersive future. Virtual reality is the OG. When people think of immersive computer-generated experiences beyond just gaming on a giant TV, VR is probably what comes to mind the most. Virtual reality generally refers to a fully immersive experience — replacing the real world with a fully computer-generated one. Typically, experiencing VR requires wearing an opaque headset that blocks your eyes from the real world. This generally counts even if the VR headset is creating a simulacrum of your surroundings. Some VR headsets, for instance, are able to project aspects of the real world into your field of view using headset-mounted cameras. Now things are getting a little muddier, but in general, AR is the counterpart to VR. While VR replaces the real world with computer-generated imagery, AR instead seeks to, erm, augment the real world with virtual experiences. Therefore, when you’re experiencing AR, your perception is still guided by real-world objects and events. Unlike VR, AR doesn’t require you to be fully immersed in a headset — or use a headset at all, for that matter. If you’ve used a Snapchat filter, you’ve used a form of AR. There are a number of apps now that allow you to superimpose 3D models onto an image of the real world — say, if you want to see how that armchair you’ve been eyeing will fit in your living room. I’m grouping these two together because depending on who you ask, these could be the same thing… or have more specific definitions. But in general, these are the two terms most often used as the over-arching terminology to encompass all computer-generated immersive experiences. Microsoft, for example, is fond of the term mixed reality as a term for all digitally-enhanced events — both AR and VR. This implies that reality and virtuality exist on a spectrum — the aptly-named reality-virtuality continuum — and has its roots in academic research for decades. It was coined by researchers Paul Milgram and Fumio Kishino in a 1994 paper. Mixed reality is everything between these two extremes, so it generally works for both AR and VR. That includes devices that offer both technologies in one; you can imagine a headset that is transparent for augmented experiences but can go opaque when the user wants to be fully immersed. There are some even more complex and specific definitions for mixed reality, but the above should suffice for most of the time you encounter the term. So what about extended reality (XR), then? Well… in most situations, it pretty much means the same thing. That said, XR has gained some traction the last few years and is often defined more broadly; it’s also supposed to also cover all possible ‘R’s we haven’t even thought of yet. Mixed reality, while including AR and VR, tends to be a bit more associated with the former. It’s also worth noting that we’ve generally been talking about replacing or adding to reality, but some researchers are also studying removing stuff from reality. This could be used, for example, to focus on a particular subject in an environment while ignoring others. The term ‘mediated reality’ is sometimes used to describe both computer-generated interactions that add to our perception, as well as those that remove from it. In general, though, you’ll see MR and XR as the most common umbrella terms, as they most reflect the experiences consumers will buy into. Which one ends up being more popular remains to be seen. I’m a fan of mixed reality due to its history, but extended reality seems to be a little easier to explain since people don’t get hung up on the ‘mixed’ part. Further details can be found on OUR FORUM.