Spyware Stealer Locker Wiper: LockerGoga Revisited

**Executive Summary:** This report summarizes analysis of LockerGoga ransomware — its emergence, role in high-impact incidents (Altran, Norsk Hydro), attacker methods (interactive compromise, AD abuse, lateral movement), and the likelihood that ransomware variants can be modified to enable disruptive, deniable operations possibly leveraged by state-directed actors, with significant implications for attribution, incident reporting, and insurance claims.