WinLocker

WinLocker is a Windows lockscreen malware component observed as part of a multi-stage malware campaign reported by FortiGuard Labs/Fortinet analysts. In the documented activity, initial access relied on social engineering: business-themed lure documents delivered in compressed archives containing malicious LNK shortcut files disguised as normal documents. Executing the shortcut launched PowerShell with execution-policy bypass to download an obfuscated first-stage loader from GitHub, while decoy documents were displayed to distract the victim. The broader campaign abused legitimate Windows functionality and public cloud services such as GitHub and Dropbox rather than exploiting software vulnerabilities, and included extensive defense evasion such as registering a fake antivirus product to disable Microsoft Defender, modifying registry settings, disabling administrative tools, and impairing recovery by disabling Windows Recovery Environment, deleting backup catalogs, and removing Volume Shadow Copies. Within this payload set, WinLocker enforced complete desktop or system lockout, displayed Russian-language ransom demands, and in some reporting showed countdown timers intended to pressure victims into contacting the attacker for ransom negotiation. It was deployed alongside other malware including Amnesia RAT and Hakuna Matata ransomware, indicating use in financially motivated extortion activity against Windows users. High-confidence behaviors directly attributed to WinLocker in the provided content are system/desktop lockout, Russian-language ransom messaging, and countdown-based coercion.