Immigration Ransomware

In our recovery lab today at Lockbit Decryptor, we isolated the Immigration ransomware strain, which our analysis confirms is a new variant of the MedusaLocker family. This variant appends the .eimmigration extension and employs a double-extortion model. Our forensic analysis indicates that while the actors threaten to publish stolen data within 72 hours, the underlying…