{
  "family": "lyposit",
  "sample_count": 27,
  "category": "ransomware",
  "description": "Lyposit (documented extensively across threat intelligence advisories under signatures including Ransom:Win32/Lyposit, Trojan-Ransom.Win32.Lyposit, and closely associated with the infamous Reveton / Citadel police locker family) is a notorious screen-locking ransomware threat active since 2012. Distributed through drive-by exploit kits (such as Blackhole and Sweet Orange) and malicious malvertising campaigns, Lyposit immediately locks the victim's desktop upon infection. It utilizes geolocation IP lookups to display a localized law enforcement banner matching the victim's country (e.g., FBI in the US, Metropolitan Police in the UK, Gendarmerie in France, BKA in Germany). The alert falsely claims illegal computer activities were detected, activates the local webcam to take a picture of the user to heighten psychological distress, and demands payment via Ukash, Paysafecard, or Bitcoin to unlock the machine.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Lyposit",
    "Trojan-Ransom.Win32.Lyposit",
    "Reveton Police Locker",
    "Trojan.Lyposit",
    "Win32/Lyposit"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Lyposit (Reveton)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lyposit is a notorious police-themed screen-locking ransomware family belonging to the Reveton malware syndicate."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lyposit customize its extortion message by country?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It queries geo-IP lookup services upon infection to display police insignia and language specific to the victim's country (e.g., FBI, BKA, Gendarmerie)."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Lyposit turn on the victim's webcam?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It displays a live webcam video feed on the lockscreen to intimidate victims into believing law enforcement is actively recording them."
      }
    },
    {
      "@type": "Question",
      "name": "How was Lyposit distributed to victims?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was primarily delivered through drive-by exploit kits (Blackhole, Sweet Orange) on compromised websites and malvertising."
      }
    },
    {
      "@type": "Question",
      "name": "How can administrators remove Lyposit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Start in Safe Mode, delete the rogue DLL/executable from %AppData%, and restore the Winlogon Shell and Run registry values."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1125",
    "T1547.001",
    "T1562.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Exploit Kits (Blackhole, Sweet Orange)",
    "Malvertising Drive-by Redirection",
    "Trojanized Media Codecs"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Geo-Targeted Police Lockscreen Display",
    "Live Webcam Feed Interception & Display",
    "Operating System Input Hooking (Lockdown)",
    "Task Manager & Registry Tools Disablement",
    "Winlogon Shell / Userinit Hijacking"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Dynamic Link Library (DLL)",
      "Encrypted Lockscreen Template (.dat)"
    ],
    "network_signatures": [
      "HTTP GET queries to public geo-IP API services followed by requests fetching localized police badge image files",
      "Outbound HTTP POST beacons transmitting payment voucher PIN codes"
    ],
    "evasion_techniques": [
      "Injecting lockscreen module directly into userinit.exe or winlogon.exe",
      "Disabling Windows Safe Mode via registry BCD modifications"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "59e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7",
      "6af0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LypositAgent",
      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit"
    ],
    "file_paths": [
      "%AppData%\\Lyposit\\reveton.dll",
      "%Temp%\\police_screen.dat"
    ]
  },
  "defensive_measures": [
    "Keep web browsers and plugins (Java, Flash, PDF readers) fully patched to prevent exploit kit drive-by infections",
    "Deploy endpoint security that detects unauthorized modifications to Winlogon Userinit and Shell registry keys",
    "Enforce web gateway filtering to block known exploit kit domains and malicious redirection gates"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Lyposit",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Lyposit"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_REVETON",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [
      "Reveton Police Locker Syndicate"
    ],
    "variants": [
      "Ransom:Win32/Lyposit.A",
      "Ransom:Win32/Lyposit.B"
    ]
  },
  "motivation": "Financial Extortion & Fraudulent Fine Coercion",
  "sample_hashes": []
}