Data by ransomware.live Windows

ProLock

ProLock is a human-operated ransomware family that emerged in 2020 as a successor to PwndLocker after weaknesses in the earlier strain enabled decryption in some cases.

Profile source: Mallory

ProLock

Family profile

ProLock is a human-operated ransomware family that emerged in 2020 as a successor to PwndLocker after weaknesses in the earlier strain enabled decryption in some cases. It primarily targeted enterprise environments, including organizations in healthcare, government, financial services, and retail, and was associated with big-game hunting and double-extortion activity in which operators stole sensitive data before encrypting systems and threatened public disclosure to pressure payment.

ProLock commonly gained access through prior compromise rather than opportunistic self-propagation. QakBot was repeatedly associated with ProLock intrusions as an initial access and staging mechanism, and exposed or compromised Remote Desktop access was also reported. Delivery chains included phishing-driven QakBot infections, after which operators used scripts, scheduled tasks, PowerShell, and remote administration utilities to deploy the ransomware across reachable systems.

Technically, ProLock encrypts files using a hybrid AES and RSA scheme and appends a ProLock-themed extension to affected files while dropping ransom instructions. Reported operator tradecraft included use of reconnaissance tooling against Active Directory, remote execution through WMIC, and lateral deployment with utilities such as PsExec and PowerShell-based mechanisms. The malware and its operators were also reported to archive and exfiltrate data prior to encryption, including use of cloud-synchronization or transfer tooling, and to inhibit recovery by deleting shadow copies and stopping processes or services that could interfere with encryption.

ProLock exhibited anti-forensics and cleanup behavior, including the ability to remove files containing its payload after execution. Analysis of incidents also described process concealment and anti-analysis measures in parts of the deployment chain. A notable operational flaw was a defective decryptor supplied to some victims after payment; multiple reports stated that it often failed on larger files and could corrupt data, making ransom payment unreliable even when victims received a decryptor.

ProLock was closely tied to the QakBot access ecosystem, and reporting later indicated that QakBot-affiliated operators shifted from deploying ProLock to deploying Egregor. ProLock is therefore best understood as a targeted enterprise ransomware operation that combined affiliate-style initial access, network-wide deployment, data theft, and extortion, but was also notable for an unreliable decryption capability that increased victim impact.

Capabilities

Defense Evasion
Exfiltration
Extortion
Lateral Movement
Reconnaissance

Operational record

YARA rules

Ransom notes

Leak sites

0 available

Reported operators

Threat actors

1 named in public reporting

Lockean

Between June 2020 and March 2021, Lockean attacked at least seven more companies with various ransomware families: Maze, Egregor, ProLock, REvil.

Exploited software

Vulnerabilities linked to ProLock

1 CVEs

CVE-2019-0859 Win32k CreateWindowEx Use-After-Free Elevation of Privilege

MITRE ATT&CK

ProLock in ATT&CK

29 distinct techniques

Techniques

29 techniques

T1105 Ingress Tool Transfer T1070.004 File Deletion T1018 Remote System Discovery T1021.002 SMB/Windows Admin Shares T1059 Command and Scripting Interpreter T1482 Domain Trust Discovery T1021 Remote Services T1486 Data Encrypted for Impact T1078 Valid Accounts T1003 OS Credential Dumping T1053.005 Scheduled Task T1490 Inhibit System Recovery T1189 Drive-by Compromise T1059.001 PowerShell T1041 Exfiltration Over C2 Channel T1583.008 Malvertising T1567.002 Exfiltration to Cloud Storage T1021.001 Remote Desktop Protocol T1570 Lateral Tool Transfer T1190 Exploit Public-Facing Application T1485 Data Destruction T1053 Scheduled Task/Job T1566 Phishing T1566.001 Spearphishing Attachment T1560.001 Archive via Utility T1027.003 Steganography T1047 Windows Management Instrumentation T1068 Exploitation for Privilege Escalation T1197 BITS Jobs

Reporting

Research mentioning ProLock

Jan 1

Sophos Threat Research

ProLock ransomware gives you the first 8 kilobytes of decryption for free | SOPHOS

ProLock ransomware was used in targeted intrusions against organizations after attackers gained access through QakBot, phishing campaigns, and exposed or compromised RDP services. Reporting linked ProLock to the earlier PwndLocker family and described it as the final stage of a broader compromise in which operators conducted reconnaissance, abused legitimate Windows processes, and used batch scripts, Task Scheduler, and PowerShell to deploy the encryptor across victim environments. Once executed, ProLock disabled processes and services, deleted shadow copies, and encrypted files larger than 8,192 bytes while leaving the first 8,192 bytes intact before appending the .prolock extension and dropping ransom notes. The campaign drew additional scrutiny after the FBI warned that some victims who paid received a faulty decryptor that corrupted files instead of restoring them, underscoring both the operational risk of payment and the likelihood that data theft could accompany the encryption phase.

Mar 22

Sentinelone Labs Subdomain

Multi-Platform SMAUG RaaS Aims To See Off Competitors - SentinelLabs

SMAUG is a ransomware-as-a-service (RaaS) operation that advertises 64-bit payloads for Windows, Linux, and macOS, positioning itself as a multi-platform option for affiliates. The service reportedly charges a 20% affiliate fee plus a 0.2 BTC registration fee, and provides a web-based campaign builder, customizable ransom demands, offline encryption, and a "Company Mode" that allows a single decryption key to unlock multiple systems inside one targeted organization. Victims are directed to a Tor-based payment portal, while operators reportedly offer automated support for both affiliates and victims and bar attacks against CIS countries. On Windows, SMAUG uses obfuscated Go binaries that gather system details and stored browser credentials, establish persistence through Registry Run Keys consistent with MITRE ATT&CK T1547.001, and then encrypt files for impact using AES-256 with keys protected by RSA-2048, aligning with T1486 Data Encrypted for Impact tradecraft. The combination of credential collection, registry-based autostart, and hybrid cryptography reflects a mature ransomware model designed to support repeatable intrusions and broad enterprise targeting across multiple operating systems.

May 18

Zdnet Zero Day