{"id":4967,"date":"2020-03-05T12:07:01","date_gmt":"2020-03-05T12:07:01","guid":{"rendered":"https:\/\/www.thecybersecuritytimes.com\/?p=4967"},"modified":"2020-03-10T13:43:04","modified_gmt":"2020-03-10T13:43:04","slug":"american-enterprises-are-becoming-victim-to-pwndlocker-ransomware","status":"publish","type":"post","link":"https:\/\/www.thecybersecuritytimes.com\/american-enterprises-are-becoming-victim-to-pwndlocker-ransomware\/","title":{"rendered":"American enterprises are becoming victim to PwndLocker ransomware"},"content":{"rendered":"\n<p>Cyberattacks are escalating in 2020, especially in the United States. Even-though enterprises have been warned and a decent security policies are deployed, companies continue to become victim to ransomware threats. Cities and enterprises in the United States are falling to PwndLocker ransomware which is asking for ransoms around $650,000. This ransomware was first discovered by the end of 2019 and since then it has encrypted number of enterprises and has demanded ransom from $175,000 to$ 650,000 until now.<\/p>\n\n\n\n<script async=\"\" src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\n<!-- Display ad -->\n<ins class=\"adsbygoogle\" style=\"display:block\" data-ad-client=\"ca-pub-6793918737846402\" data-ad-slot=\"2435745788\" data-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script>\n     (adsbygoogle = window.adsbygoogle || []).push({});\n<\/script>\n\n\n\n<p>As per reports from Bleeping Computer, it seems the PwndLocker&#8217;s creators have stolen some files from the Lasalle&#8217;s county and had demanded for ransom, but that county had&nbsp;<a href=\"http:\/\/www.wspynews.com\/news\/local\/lasalle-county-government-continuing-to-battle-apparent-ransomware-issues\/article_0145e2a2-5741-11ea-8d07-47ff578191a7.html\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">denied<\/a> the payment of ransom. These attackers have also&nbsp;<a href=\"https:\/\/www.021.rs\/story\/Novi-Sad\/Vesti\/235654\/Blokirani-serveri-novosadskih-sluzbi-hakeri-traze-bitkoine-da-bi-otkljucali-vredne-baze-podataka.html\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\" (opens in a new tab)\">encrypted<\/a> data from City of Novi Sad in Serbia.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How does PwndLocker ransomware work?<\/h2>\n\n\n\n<p>According to the reports produced by MalwareHunterTeam as shown below,&nbsp;<\/p>\n\n\n\n<blockquote class=\"twitter-tweet\"><p lang=\"en\" dir=\"ltr\">So, there&#8217;s a ransomware which we just call PwndLocker.<br>Not coded by skids&#8230;<br>Getting victims all over Earth&#8230;<br>Going for months, with like ~nothing about it public&#8230;<br>&#8220;The price depends on the network size, number of employess and annual revenue.&#8221;<a href=\"https:\/\/twitter.com\/demonslay335?ref_src=twsrc%5Etfw\">@demonslay335<\/a><br>cc <a href=\"https:\/\/twitter.com\/VK_Intel?ref_src=twsrc%5Etfw\">@VK_Intel<\/a> <a href=\"https:\/\/t.co\/u4arK4Hn7J\">pic.twitter.com\/u4arK4Hn7J<\/a><\/p>\u2014 MalwareHunterTeam (@malwrhunterteam) <a href=\"https:\/\/twitter.com\/malwrhunterteam\/status\/1230576922356305922?ref_src=twsrc%5Etfw\">February 20, 2020<\/a><\/blockquote> <script async=\"\" src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n\n\n\n<p>Once the ransomware enters the system using conventional phishing scams, it stops a substantial amount of windows and application services using the &#8216;net stop&#8217; command for its uninterrupted process of encrypting the system. <\/p>\n\n\n\n<p>Services like MQSQL, Veeam, Exchange, Acronis, Zoolz, Kaspersky, Sophos, Malwarebytes, McAfee and more. Apart from services, this&nbsp;malware also disables process like Firefox, Excel, Access, Word and other process based software, databases and backup applications. After it has prepared the system for the encryption, it begins its process and make sure it skips files that aren&#8217;t under its radar, for example: .exe, .dll, .cmd, .bat, etc.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"620\" src=\"https:\/\/www.thecybersecuritytimes.com\/wp-content\/uploads\/2020\/03\/ransom-note-1024x620.jpg\" alt=\"\" class=\"wp-image-4969\"\/><figcaption>PwndLocker ransomware note<\/figcaption><\/figure>\n\n\n\n<p>After encrypting the files in the targeted computer, this ransomware leaves .key and .pwnd extension on all the files. Displays a ransom note, allows victims to unlock two files for free and to access others they would need to pay the ransom.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"715\" src=\"https:\/\/www.thecybersecuritytimes.com\/wp-content\/uploads\/2020\/03\/payment-site-1024x715.jpg\" alt=\"\" class=\"wp-image-4970\"\/><\/figure>\n\n\n\n<p>Proactive cybersecurity is the right way ahead against ransomware threats, but that can&#8217;t stand the threat if sufficient tools and awareness aren&#8217;t established already.<\/p>\n\n\n\n<p>Subscribe to\u00a0<strong>\u2018The Cybersecurity Times\u2019<\/strong>, for daily alerts on cyber events. You can also follow us on\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/www.facebook.com\/thecybersecurittytimes\/\" target=\"_blank\">Facebook<\/a>,\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/www.linkedin.com\/company\/the-cybersecurity-times\/\" target=\"_blank\">Linkedin<\/a>,\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/www.instagram.com\/the_cybersecurity_times\/\" target=\"_blank\">Instagram<\/a>,\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/twitter.com\/the_cybertimes\" target=\"_blank\">Twitter<\/a>\u00a0and\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/www.reddit.com\/r\/Cybersecurity_times\/\" target=\"_blank\">Reddit<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cities and enterprises in the United States are falling to PwndLocker ransomware which is asking for ransoms around $650,000. This ransomware was first discovered by the end of 2019 and since then it has encrypted number of enterprises and has demanded ransom from $175,000 to$ 650,000 until now.<\/p>\n","protected":false},"author":8,"featured_media":4971,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[72,108,91],"tags":[285,286],"class_list":["post-4967","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking","category-data-security","category-latest-cybersecurity-news","tag-pwndlocker","tag-pwndlocker-ransomware-attack"],"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/posts\/4967"}],"collection":[{"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/comments?post=4967"}],"version-history":[{"count":2,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/posts\/4967\/revisions"}],"predecessor-version":[{"id":4980,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/posts\/4967\/revisions\/4980"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/media\/4971"}],"wp:attachment":[{"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/media?parent=4967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/categories?post=4967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thecybersecuritytimes.com\/wp-json\/wp\/v2\/tags?post=4967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}