Emsisoft Releases Free Decryptor for PwndLocker Ransomware

Emsisoft disclosed a weakness in PwndLocker ransomware that allows victims to recover encrypted files without paying, offering a free decryption path for organizations hit by the malware. The ransomware had targeted municipalities, government services, and enterprises in the United States and Europe, with reported ransom demands ranging from $175,000 to more than $660,000; named victims included LaSalle County, Illinois, which reportedly faced a 50 bitcoin demand, and the City of Novi Sad, Serbia, where more than 50 TB of data was encrypted.

PwndLocker, also tracked in some cases as KeyLocker, typically used the ransom note H0w_T0_Rec0very_Files.txt, appended extensions such as .pwnd and .key, and threatened to leak stolen data while increasing the ransom over time. Researchers said victims need a copy of the ransomware executable used in the attack to enable recovery, even though operators often delete it after deployment; potential recovery locations include %Temp%, C:\User, and %AppData%, and the file may also be recoverable through Shadow Explorer or file recovery tools. Separate reporting also noted a flaw in the attackers’ own decryptor that could fail on files larger than 64 MB, meaning some victims might not have been able to fully restore data even after paying.