LCRYX Ransomware Scancode Map and SwapMouseButtons Registry Manipulation

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects LCRYX ransomware modifying registry keys to impair analyst interaction. It specifically monitors for the creation of the Scancode Map registry key, used to disable keyboard input, and the modification of the SwapMouseButtons registry key, used to invert mouse button functionality.