Threat taxonomy
medium activityRansomwareFirst seen 2025
HararCrypt
Aliases: HC-Locker
A locker build observed in East African incidents, distinguished by localised ransom notes and targeting of file servers holding loan and KYC documentation.
Attribution
Regionally active affiliate build
Primary targets
- — Microfinance
- — Cooperative banks
- — Legal and audit suppliers
Observed tactics
- Phishing with invoice attachments
- Credential reuse against file servers
- Selective encryption of document repositories
Regional relevance
Focus on KYC document stores creates regulatory exposure beyond the operational outage itself.
Detection guidance
- Monitor for mass file rename operations on document shares
- Alert on shadow copy deletion commands
- Watch for archiving utilities run on file servers
Related feed reporting
- high11 Sept 2026
Ransomware affiliate leaks data claimed from a regional microfinance group
- medium24 Aug 2026
Ransomware crew adds double-extortion pressure via regulator notification threats