WinLocker

WinLocker is a malware component used to enforce desktop or full system lockout as part of broader multi-stage Windows malware campaigns. In the provided reporting, WinLocker appears alongside other payloads including Amnesia RAT and Hakuna Matata ransomware after initial compromise via social engineering: business-themed lure documents in compressed archives containing malicious LNK files that launch PowerShell with execution-policy bypass and retrieve loaders from GitHub. The campaigns abuse legitimate Windows security mechanisms rather than software vulnerabilities, including registering a fake antivirus product to disable Microsoft Defender, modifying the registry to disable security controls and administrative tools, and impairing recovery by disabling Windows Recovery Environment, deleting backup catalogs, and removing Volume Shadow Copies. WinLocker specifically is described as displaying Russian-language ransom demands, enforcing complete desktop or system lockout, and in some cases showing countdown timers to pressure victims into contacting the attacker for ransom negotiation. Separate reporting also references a ransomware 'WinLocker' screen within a Python Flask malware toolkit referred to as InfernoGrabber v9.0, which masquerades as a Discord avatar AI upscaler, exfiltrates data through a hard-coded Discord webhook, and presents a Bitcoin ransom screen. High-confidence associated behaviors and context include Windows targeting, ransom/extortion functionality, lock-screen behavior, Russian-language ransom messaging, and use within campaigns that also deploy credential theft, crypto-wallet theft, surveillance, and file-encrypting ransomware.