Loading malware…
ProLock is a human-operated ransomware family that emerged in 2020 as a successor to PwndLocker after weaknesses in the earlier strain enabled decryption in some cases. It primarily targeted enterprise environments, including organizations in healthcare, government, financial services, and retail, and was associated with big-game hunting and double-extortion activity in which operators stole sensitive data before encrypting systems and threatened public disclosure to pressure payment.
ProLock commonly gained access through prior compromise rather than opportunistic self-propagation. QakBot was repeatedly associated with ProLock intrusions as an initial access and staging mechanism, and exposed or compromised Remote Desktop access was also reported. Delivery chains included phishing-driven QakBot infections, after which operators used scripts, scheduled tasks, PowerShell, and remote administration utilities to deploy the ransomware across reachable systems.
Technically, ProLock encrypts files using a hybrid AES and RSA scheme and appends a ProLock-themed extension to affected files while dropping ransom instructions. Reported operator tradecraft included use of reconnaissance tooling against Active Directory, remote execution through WMIC, and lateral deployment with utilities such as PsExec and PowerShell-based mechanisms. The malware and its operators were also reported to archive and exfiltrate data prior to encryption, including use of cloud-synchronization or transfer tooling, and to inhibit recovery by deleting shadow copies and stopping processes or services that could interfere with encryption.
ProLock exhibited anti-forensics and cleanup behavior, including the ability to remove files containing its payload after execution. Analysis of incidents also described process concealment and anti-analysis measures in parts of the deployment chain. A notable operational flaw was a defective decryptor supplied to some victims after payment; multiple reports stated that it often failed on larger files and could corrupt data, making ransom payment unreliable even when victims received a decryptor.
ProLock was closely tied to the QakBot access ecosystem, and reporting later indicated that QakBot-affiliated operators shifted from deploying ProLock to deploying Egregor. ProLock is therefore best understood as a targeted enterprise ransomware operation that combined affiliate-style initial access, network-wide deployment, data theft, and extortion, but was also notable for an unreliable decryption capability that increased victim impact.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Between June 2020 and March 2021, Lockean attacked at least seven more companies with various ransomware families: Maze, Egregor, ProLock, REvil.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Hacker gangs breach or rent access to a hacked network, take manual control of the infected host, spread laterally through the network, and then deploy the ransomware after they've maximized their access.
Кроме того, ProLock может распространяться ... с помощью обманных загрузок, ботнетов, эксплойтов, вредоносной рекламы, веб-инжектов, фальшивых обновлений, перепакованных и заражённых инсталляторов.
Кроме того, ProLock может распространяться ... с помощью ... эксплойтов
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
QakBot загружает пакетные сценарии из облачного хранилища и выполняет их с помощью команды: schtasks.exe /CREATE /XML C:\Programdata\WinMgr.xml /tn WinMgr schtasks.exe /RUN /tn WinMgr
schtasks.exe /CREATE /XML C:\Programdata\WinMgr.xml /tn WinMgr schtasks.exe /RUN /tn WinMgr
QakBot загружает пакетные сценарии из облачного хранилища и выполняет их с помощью команды: schtasks.exe /CREATE /XML C:\Programdata\WinMgr.xml /tn WinMgr schtasks.exe /RUN /tn WinMgr
QakBot загружает пакетные сценарии из облачного хранилища и выполняет их с помощью команды: schtasks.exe /CREATE /XML C:\Programdata\WinMgr.xml /tn WinMgr schtasks.exe /RUN /tn WinMgr
schtasks.exe /CREATE /XML C:\Programdata\WinMgr.xml /tn WinMgr schtasks.exe /RUN /tn WinMgr
APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges. ... APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host. ... multiple groups/tools exploit various CVEs to escalate privileges.
ProLock использует PowerShell для внедрения в память специального файла WinMgr.bmp . Файл в заголовке является файлом BMP или JPG, за которым идут нули, а затем код вымогателя.
With attackers leveraging the features that enable a user to execute processes on remote systems, PsExec can be abused for arbitrary command shell execution and lateral movement.
ProLock может распространяться путём взлома через незащищенную конфигурацию RDP со слабыми паролями
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware payload dropped by Lockean affiliates on systems infected via Qbot/QakBot with TA551 collaboration.
Ransomware family discussed in terms of its attack chain and TTPs.
Targeted ransomware that encrypts files larger than 8,192 bytes starting after the first 8,192 bytes, appends the .prolock extension, drops ransom notes, deletes shadow copies, kills processes and services, and is deployed via PowerShell/batch scripts while hiding execution inside legitimate Windows processes.
Ransomware that removes volume shadow copies using vssadmin.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.