The first sign that something has gone wrong is a line of text on the console: [*] Linux Locker v1.0 started. By the time an administrator reads it, the encryption is already running, and so is the part that matters more, which is the deliberate destruction of the machine's local backups.
Colombia's national cyber emergency response team, ColCERT, obtained a sample of the ransomware and detonated it in a controlled environment, publishing the results as alert AL-20260908-117 under TLP:CLEAR on September 8. It rates the threat high. The team calls the family Linux Locker, which is the name the artifact prints about itself, and the alert is written for IT departments rather than for malware analysts.
It goes for the recovery path first
What ColCERT observed in the lab is short and unpleasant. Files across user data, applications and system components were encrypted and given a .linux extension. The originals were deleted once their encrypted copies existed, so there is no partially encrypted state to salvage. And the sample actively went after the places a Linux administrator would turn to recover: /var/backups/, the /swap.img file, and the local package cache.
That ordering is the finding. Plenty of ransomware encrypts a Linux server. A sample that treats the backup directory and the package cache as targets in their own right is not simply denying access to data, it is removing the ability to rebuild the machine, which turns an outage into a much longer one for anyone whose recovery plan assumed the local copies would still be there.
No call home before encrypting
ColCERT flags one behavior as the reason the window to react is so narrow. In the observed execution, encryption did not depend on contacting an external server first. Ransomware that fetches or registers a key before starting gives defenders a beacon to catch and a few minutes of network noise to notice. This one did not offer that. Once the file runs, the outbound network detection that many organizations lean on has nothing to fire on, and the first indicator is the console banner.
The alert does not say how the sample reached the machines it analyzed, does not name an operator or a leak site, and publishes no infrastructure. Readers should take it for what it is: a behavioral summary drawn from one sample in one lab, aimed at helping Colombian IT teams recognize the damage pattern quickly.
Keep one copy the host cannot reach
The remediation follows directly from the behavior. Local backups are not backups against this family. Recovery copies need to live somewhere the compromised host has no write access to, whether that is offline media, an append-only repository or a separate account with its own credentials, and they need a restore test that someone has actually run. Alerting on mass rename activity and on sudden writes to /var/backups/ is worth more here than perimeter detection, because the malware gives the perimeter nothing to see.
Colombia has been an unusually busy source of ransomware advisories this year, and ColCERT has spent much of it warning about crews operating against local organizations, including a ransomware-as-a-service operation openly recruiting affiliates in August. The country profile and the incidents we track against it are collected on our Colombia page. This alert is narrower than those, and more useful for it: no attribution, no speculation, just what the thing does to a server once it runs.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.