That code, Carmakal says, is signed with stolen certificates that make it look more legitimate. LockerGoga then rapidly encrypts the computer's files. On an average system within a few minutes, it is toast," wrote Kevin Beaumont, a UK security researcher, in an analysis of the Norsk Hydro attack