No one likes Locky ransomware. The name is cute, but the execution is awful: A victim’s files are scrambled and then renamed. What’s more, any VSS or shadow copies are destroyed in the process, and the malware also scrambles data in any mounted drive it can access.

According to SecurityWeek, however, an unknown white-hat hacker has gained access to Locky’s command-and-control (C&C) server and replaced the ransomware with a small executable that says “Stupid Locky.” The effort raises an interesting question: Is dumbing down malware the next step in effective defense?

Hacking Locky Ransomware

Locky has made a name for itself over the past few months as a highly effective ransomware that’s extremely difficult to remove. It can encrypt more than 160 file types and demands between $220 and $880 (in bitcoin, of course) from victims to unlock their files. Since the bitcoin wallet file is on Locky’s list of encryptable files, many users prefer to pay up rather than risk the loss of their virtual currency.

According to researchers from Avira, it looks like a white hat has tracked down one of the ransomware’s C&C servers, breached the defenses and made some changes. When recipients open the “unpaid fine” attachment in an infected spam email, the downloader doesn’t grab malicious Locky, but rather a 12 KB file that fails to execute.

The result? User systems are spared and the Locky ransomware creators get nothing. While no one has stepped up to take responsibility, Avira researcher Sven Carlsen doesn’t think Locky authors are behind the change “because of the potential damage to their reputation and income stream.” He also said this isn’t the end of Locky, but it suggests that cybercriminals may not be as smart as they appear.

Under the Hat

Standard ransomware defense focuses on educating employees to avoid suspicious emails, implementing software tools that detect potential infection and encouraging practices designed to minimize damage after the fact. As the Locky hack demonstrates, however, the security market is undergoing a significant shift.

Consider the recent discovery of a serious flaw in Instagram, which let any user delete anyone’s content by modifying a few lines of code, discovered by a 10-year-old from Finland. He nabbed a $10,000 bounty for his effort and demonstrated that great ideas often come from unlikely places.

So, too, with white hats: While companies aren’t funding aggressive pushback efforts against malware just yet, the work of Locky’s nemesis shows that sometimes a dose of cybercriminals’ own medicine is an incredibly effective deterrent.

Bottom line? The color’s the same, but what’s under the hat is changing. IT pros working within the confines of corporate operations are now middle ground; the front lines are occupied by good guys with a sense of humor — a new generation of digital natives ready to disrupt technology as a matter of course.