Netskope Threat Labs

RansomLock

ATP Sandbox Adv. Heuristics

RansomLock is a detection family for screen locking ransomware that demands payment to unlock the infected machine. Variants documented by Symantec in 2012 included police themed extortion screens demanding fines through payment systems such as Ukash.

First seen
May 2022
Last seen
September 2026
Alert Name
ByteCode-MSIL.Ransomware.RansomLock
Script-JS.Ransomware.RansomLock
Win32.Ransomware.RansomLock
Win64.Ransomware.RansomLock