Loading story…
Emsisoft disclosed a weakness in PwndLocker ransomware that allows victims to recover encrypted files without paying, offering a free decryption path for organizations hit by the malware. The ransomware had targeted municipalities, government services, and enterprises in the United States and Europe, with reported ransom demands ranging from $175,000 to more than $660,000; named victims included LaSalle County, Illinois, which reportedly faced a 50 bitcoin demand, and the City of Novi Sad, Serbia, where more than 50 TB of data was encrypted.
PwndLocker, also tracked in some cases as KeyLocker, typically used the ransom note H0w_T0_Rec0very_Files.txt, appended extensions such as .pwnd and .key, and threatened to leak stolen data while increasing the ransom over time. Researchers said victims need a copy of the ransomware executable used in the attack to enable recovery, even though operators often delete it after deployment; potential recovery locations include %Temp%, C:\User, and %AppData%, and the file may also be recoverable through Shadow Explorer or file recovery tools. Separate reporting also noted a flaw in the attackers’ own decryptor that could fail on files larger than 64 MB, meaning some victims might not have been able to fully restore data even after paying.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Emsisoft, through analysis by Fabian Wosar, discovered a flaw in PwndLocker that allows victims to recover encrypted files without paying the ransom, provided they can supply the ransomware executable used in the attack.
A February 24, 2020 update associated PwndLocker with the email address help0f0ry0u@protonmail.com and the Tor URL ax3spapdymip4jpy.onion.
The campaign described in the reference continued into February 2020 after its late-2019 activity, indicating ongoing ransomware operations against organizations.
The referenced content says PwndLocker activity was concentrated from October through December 2019, targeting municipal administrations, government services, enterprises, and other organizations in the United States, Serbia, and other European countries.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Lorenz** ransomware operation emerged as an enterprise-focused threat using **double extortion**: attackers stole unencrypted data before encrypting systems, then pressured victims by publishing stolen files on a leak site and, in some cases, offering both the data and internal network access for sale. Reported ransom demands ranged from **$500,000 to $700,000**, with victims directed to a dedicated Tor payment portal featuring Bitcoin payment instructions and live chat. Researchers said the malware appears linked to earlier **ThunderCrypt** and **SZ40** ransomware, though it remained unclear whether the same operators were involved or whether code had been reused. Analysis of the malware showed it uses **AES** encryption with an embedded **RSA** key, appends the `.Lorenz.sz40` extension to encrypted files, and drops a ransom note named `HELP_SECURITY_EVENT.html`. A later breakthrough by Tesorion led to a **free decryptor** being added to the **NoMoreRansom** project, allowing recovery of some files without paying. The researchers found a flaw in Lorenz’s encryption routine that irreversibly destroys the last **48 bytes** of files whose size is a multiple of 48 bytes, meaning some data remains corrupted even if decrypted, while other file types such as Microsoft Office documents, PDFs, and some images and videos can be recovered in certain cases.
Aug 15, 2026
Law enforcement and industry partners released a free **No More Ransom** decryption tool for victims of **GandCrab** ransomware, offering recovery support for most known variants of one of 2018’s most widespread ransomware families. Europol said the tool was developed with the Romanian Police, international law enforcement partners, and Bitdefender, and came after GandCrab had infected nearly half a million victims worldwide while demanding payments ranging from **$300 to $6,000** in **Bitcoin** or **DASH**. The release marked a significant disruption of a ransomware-as-a-service operation that had scaled rapidly through affiliate partnerships across the cybercrime ecosystem. GandCrab had spread through multiple delivery channels, including malspam campaigns disguised as receipts or order notices and payloads hosted on compromised legitimate websites. Reporting from Cisco Talos and BleepingComputer described infection chains using ZIP archives, macro-enabled Word documents, VBScript, fake CAPTCHA pages, and PowerShell-based downloaders, with some campaigns also abusing compromised sites and `certutil.exe` to retrieve payloads. Once executed, GandCrab encrypted files, appended the `.CRAB` extension, altered desktop wallpapers, and communicated through infrastructure including Tor and **Namecoin `.bit` domains**, underscoring both the scale of the threat and the practical value of the newly released decryptor.
Aug 15, 2026
Researchers detailed how **WastedLocker** was used in targeted intrusions against large enterprises, including a build linked to Garmin’s service-disrupting encryption incident. The ransomware was deployed after operators gained access through tools and malware such as **SocGholish** and **Cobalt Strike**, then moved through victim environments with living-off-the-land utilities including **PsExec**, **PowerShell**, and **WMIC**. Victims included high-value organizations and several U.S.-based Fortune 500 companies, underscoring the malware’s role in carefully tailored, big-game ransomware operations. Technical analysis shows WastedLocker sought elevated privileges with a UAC bypass, hid execution through **NTFS alternate data streams**, temporarily persisted as a system service during encryption, disabled Windows Defender protections, and deleted Volume Shadow Copies to hinder recovery. It encrypted local, network, and removable-drive files with **AES-CBC** using per-file keys protected by **RSA-4096**, then renamed files with victim-specific extensions such as `.garminwasted` or company-name variants ending in `wasted`, while dropping per-file ransom notes or companion info files directing victims to contact the attackers through secure email services.
Aug 15, 2026