PwndLocker

PwndLocker is a targeted ransomware family that emerged in late 2019 and was used against businesses, municipal administrations, government services, and other organizations. It encrypts victim data and demands high-value ransoms, with reported campaigns focusing on enterprise and public-sector networks in multiple countries. The malware has been associated with double-extortion behavior, with operators claiming to steal sensitive data before encryption and threatening public release if victims refuse to pay.

On compromised Windows environments, PwndLocker attempts to maximize encryption impact by terminating a broad set of security, backup, database, mail, and server-related processes and services, and by deleting shadow copies to hinder recovery. It has been observed dropping ransom notes throughout affected systems and using victim-specific encrypted-file extensions. Reporting also indicates propagation or staging through removable media in some cases.

PwndLocker has been linked to multiple initial access vectors, including exposed or insecure RDP access, phishing and malicious attachments, deceptive downloads, fake updates, malvertising, exploit-driven delivery, botnet-assisted distribution, and trojanized installers. The operators reportedly perform victim-environment assessment before launching encryption, consistent with targeted intrusion activity rather than indiscriminate mass deployment.

The family is notable for weaknesses in its implementation. Security researchers identified a flaw that enabled decryption in some cases, and reporting also noted that the original decryptor used by the operators could fail on larger files, making ransom payment unreliable. PwndLocker is also widely described as the predecessor of ProLock, which appeared as a successor or reworked follow-on family after PwndLocker’s initial activity.