Technique:  System Location Discovery:System Language Discovery
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.
Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.
Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.
Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.
Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.
DropBook has checked for the presence of Arabic language in the infected machine's settings.
Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.
GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.
It has used implants to collect the system language ID of a compromised machine.
MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.
Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.
Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call GetKeyboardType.
Neoichor can identify the system language on a compromised host.
During Operation Dream Job, It deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.
REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage. If the language is found in the list, the process terminates.
Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage. If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.
S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the GetKeyboardType API call.
SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.
Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word "Arabic" before executing.
SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.
XCSSET uses AppleScript to check the host's language and location with the command user locale of (get system info).
Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.