Netskope Threat Labs

Pwndlocker

ATP Sandbox Adv. Heuristics

Pwndlocker is a ransomware family observed in late 2019 that targeted businesses and local governments, with reported ransom demands ranging from 175 thousand to 650 thousand dollars depending on network size. It disables Windows services and terminates processes related to browsers, security, backups, and databases, clears shadow copies, and skips executables and files critical for the system to keep functioning.

First seen
May 2022
Last seen
September 2026
Alert Name
Win32.Ransomware.Pwndlocker