Loading story…
ProLock ransomware was used in targeted intrusions against organizations after attackers gained access through QakBot, phishing campaigns, and exposed or compromised RDP services. Reporting linked ProLock to the earlier PwndLocker family and described it as the final stage of a broader compromise in which operators conducted reconnaissance, abused legitimate Windows processes, and used batch scripts, Task Scheduler, and PowerShell to deploy the encryptor across victim environments.
Once executed, ProLock disabled processes and services, deleted shadow copies, and encrypted files larger than 8,192 bytes while leaving the first 8,192 bytes intact before appending the .prolock extension and dropping ransom notes. The campaign drew additional scrutiny after the FBI warned that some victims who paid received a faulty decryptor that corrupted files instead of restoring them, underscoring both the operational risk of payment and the likelihood that data theft could accompany the encryption phase.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In May 2020, the FBI said ProLock operators were gaining access to victim networks through Qakbot infections, indicating that Qakbot-compromised systems could be used as entry points for ransomware deployment. The article also noted Group-IB had observed the same Qakbot-to-ProLock relationship.
In May, the FBI issued an alert saying some ProLock victims who paid the ransom received a faulty decryptor that corrupted files instead of restoring them properly. The FBI also said victims included healthcare organizations, government agencies, financial institutions, and retailers.
Sophos first encountered ProLock on a customer network in mid-March, when Intercept X CryptoGuard detected the ransomware. Sophos assessed that this early case likely involved exploitation of an RDP connection on a compromised server.
ProLock appeared in March as a reworked version of PwndLocker. The ransomware became part of a broader wave of targeted attacks during the COVID-19 period.
PwndLocker's distribution was short-lived because decryption keys could be recovered from the malware itself without paying the ransom. This weakness preceded the appearance of ProLock as its successor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcezdnet.com
Open sourceid-ransomware.blogspot.com
Open sourcegroup-ib.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Basta emerged as a fast-growing ransomware-as-a-service operation that hit organizations across the United States, Canada, the United Kingdom, Australia, and New Zealand, with victims reported in manufacturing, construction, transportation, telecommunications, and pharmaceuticals. The group has been tied to human-operated intrusions that begin with spearphishing emails and password-protected ZIP archives, often delivering **QakBot** through ISO or JavaScript-based loaders that can bypass Windows Mark-of-the-Web protections, including abuse linked to `CVE-2022-44698`. After initial access, the attackers use **SystemBC**, **Cobalt Strike**, and **Mimikatz** for command and control, credential theft, persistence, and lateral movement, including SMB service execution and **PsExec**. Black Basta operators commonly try to disable Windows Defender and EDR tools, exfiltrate data with **Rclone**, delete volume shadow copies, encrypt files with the `.basta` extension, and leave a `readme.txt` ransom note while threatening to publish stolen data on a TOR leak site if payment is not made.
Aug 15, 2026
Threat actors used **QakBot** (also tracked as **QBot/QuackBot**) as an initial access and post-compromise platform in corporate intrusions, delivering the malware through phishing campaigns that evolved from malicious Office documents to password-protected ZIP archives, **MSI** installers, **OneNote** files, **LNK/XLL** payloads, and script-based chains. Across these campaigns, QakBot established persistence, injected into legitimate processes, conducted host and domain reconnaissance, stole credentials and other data, and communicated with command-and-control servers over encrypted HTTP/HTTPS channels before staging additional payloads.
Aug 15, 2026
U.S. and European law enforcement agencies disrupted the **QakBot** botnet, seizing infrastructure tied to malware that had infected more than **700,000 computers** worldwide and enabled ransomware, financial fraud, and other criminal activity. Europol and U.S. authorities said the operation cut off command-and-control systems and removed malware from compromised hosts, while CISA published guidance on the botnet’s tactics, indicators, and the broader effort to identify and disrupt the infrastructure behind it. Officials said QakBot operators and affiliates had generated at least **EUR 54 million** in ransom payments over the years. The takedown also produced a large cache of stolen data that the FBI shared for victim notification, allowing affected individuals to check exposed information through **Have I Been Pwned**. Reporting after the operation said the action could serve as a model for future botnet disruptions, with investigators using legal authorities and international coordination to seize servers, redirect traffic, and weaken criminal ecosystems that support follow-on ransomware attacks.
Jul 12, 2026