PwndLocker
Aliases: ProLock
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-04-20 02:55:23
- Profile updated
- 2026-07-07 12:58:22
Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical professional-services
Context
PwndLocker, also known as ProLock, is a ransomware family that targets various industries, encrypting data and demanding ransom payments in cryptocurrency. It is known for its rapid spread and significant impact on affected organizations.
Detection coverage
- 4 YARA rules
Detection rules
- MALPEDIA_Win_Pwndlocker_Auto (yara-rule)
- DITEKSHEN_MALWARE_Win_Prolock (yara-rule)
- SIGNATURE_BASE_MAL_Prolock_Malware (yara-rule)
- R3C0NST_Prolock_Malware (yara-rule)
Reports & references
- CrowdStrike — Report2021Gtr (report)
- cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
- web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
- cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
- cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
- cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
- cyborgsecurity.com — Hunting Ransomware Inhibiting System Backup Or Recovery (report)
- pwc.co.uk — What Is Behind Ransomware Attacks Increase (report)
- medium.com — Operation Synctrek E5013Df8D167 (report)
- zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
- id-ransomware.blogspot.com — Pwndlocker Ransomware (report)
- news.sophos.com — Prolock Ransomware Gives You The First 8 Kilobytes Of Decryption For Free (report)
- norfolkinfosec.com — Tinypos And Prolocker An Odd Relationship (report)
- raw.githubusercontent.com — When%20Ransomware%20Hits%20An%20Atm%20Giant%20 %20The%20Diebold%20Nixdorf%20Case%20Dissected%20 %20Group Ib%20Cybercrimecon2020 (report)
- soolidsnake.github.io — Prolock Ransomware (report)
- bleepingcomputer.com — New Pwndlocker Ransomware Targeting Us Cities Enterprises (report)
- bleepingcomputer.com — Pwndlocker Ransomware Gets Pwned Decryption Now Available (report)
- cert-pa.it — Pwndlocker Si Rinnova In Prolock Ransomware (report)
- group-ib.com — Prolock (report)
- group-ib.com — Prolock Evolution (report)
- hornetsecurity.com — Qakbot Malspam Leading To Prolock (report)
- hornetsecurity.com — Qakbot Reducing Its On Disk Artifacts (report)
- intrinsec.com — Egregor Prolock (report)
- it-klinika.rs — Paznja Novi Opasni Ransomware Pwndlocker I U Srbiji (report)