PwndLockerMalware
- ProLock
PwndLocker is a ransomware that was observed in late 2019 and is reported to have been used to target businesses and local governments/cities. According to one source, ransom amounts demanded as part of PwndLocker activity range from $175k USD to $650k USD depending on the size of the network. PwndLocker attempts to disable a variety of Windows services so that their data can be encrypted.From MISP Galaxy
Last reported 5 years ago, by Group-IB5 reports
ATT&CK techniques
6 of 35 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“ProLock operators used two main vectors of initial access: QakBot (Qbot) and unprotected Remote Desktop Protocol (RDP)-servers with weak credentials.”
- T1036Masquerading
“…Signing (T1116), Deobfuscate/Decode Files or Information (T1140), Disabling Security Tools (T1089), File Deletion (T1107), Masquerading (T1036), Process Injection (T1055)”
- T1053.005Scheduled Task
“In some cases, a scheduled task is used to run PowerShell:”
- T1110Brute Force
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
- T1133External Remote Services
“External Remote Services (T1133), Spearphishing Attachment (T1193), Spearphishing Link (T1192)”
- T1003OS Credential Dumping
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
What the reports say
5 reports, newest first · the exact sentence from each-
REvil Twins: Ransomware-as-a-Service program“In the past, IcedID was known to have been used by Maze, Egregor and Conti affiliates, while Qakbot – by ProLock, Egregor and DoppelPaymer.”
-
Connecting the Bots“Similar scripts were observed to be used by ProLock and Egregor operators.”
-
The Locking Egregor“The close similarities in TTPs with earlier ProLock campaigns indicate that Qakbot operators have likely abandoned ProLock for Egregor.”
-
Lock Like a Pro“On September 4, the FBI issued its second alert in less than six months about ProLock warning companies of the fact that the ransomware operators are stealing data from targeted organizations before encrypting them.”
-
ATT&CKing ProLock Ransomware“ATT&CKing ProLock Ransomware”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
Copy this indicator · defanged
Thanks — we review every report.