ColdLock Ransomware Hits Taiwanese Organizations

Cyble reports a new ransomware family named ColdLock active since May 2020 that has infected several Taiwanese organizations, including a major mining company. ColdLock is delivered as a ConfuserEx-protected .NET DLL executed via PowerShell reflective loading, targets databases and email servers for encryption, performs environment checks (presence of %SystemRoot%\ProgramData\readme.tmp and a time-of-day check), terminates services that block file access, and executes Windows 10-specific routines to disable Defender and reporting; researchers note code and behavioral overlaps with EDA2, LockerGoga and Freezing.