{
  "family": "pinkblocker",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransom:Win32/Pinkblocker is a highly disruptive, screen-locking extortion trojan. Unlike cryptographic ransomware (which encrypts files), Pinkblocker operates by aggressively hijacking the Windows user interface, preventing all interaction with the desktop, taskbar, and applications, and demanding a ransom payment to restore access to the computer.<br><br><b>Understanding Pinkblocker (Screen Locker)</b><br>To an end-user, the infection is terrifying: upon booting the computer or executing a malicious file, the screen goes entirely pink (or displays a threatening ransom note), and neither the mouse nor keyboard shortcuts (like Ctrl+Alt+Del) seem to function. For a security analyst, Pinkblocker is generally considered a lower-tier threat than crypto-ransomware because the underlying user data (`T1486`) is not actually destroyed or encrypted; the malware merely blocks access to the operating system shell (`T1491.001`).<br><br><b>Execution and Locking Mechanics</b><br>Pinkblocker is typically distributed via malicious links, fake software cracks, or malspam (`T1204.002`). Upon execution, it establishes intense persistence, often overwriting the default Windows Shell (`explorer.exe`) in the registry (`HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) (`T1547.004`). When the user logs in, instead of loading the desktop, Windows loads the Pinkblocker interface. The malware frequently utilizes hooking techniques (`T1056.002` - applied to input blocking) to intercept and suppress critical keystrokes like the Windows key, Alt+Tab, and Ctrl+Alt+Del, locking the user into the ransom screen.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of productivity and severe denial of service to the affected endpoint, though the data remains intact. Host-based IoCs include the modification of the `Winlogon\\Shell` registry key, the presence of the blocking executable in the Startup folder, and the overt, inescapable pink screen demanding payment.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.004",
    "T1056.002",
    "T1491.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement (Screen locking)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell Hijacking)",
      "tactic": "Persistence"
    },
    {
      "id": "T1056.002",
      "name": "Input Capture: GUI Input Capture (Blocking keyboard shortcuts)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Hard reboot the infected machine into 'Safe Mode with Command Prompt' (which often bypasses the Winlogon Shell hijack).",
    "Use the command-line Registry Editor (`regedit`) to navigate to `HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon` and change the `Shell` value back to `explorer.exe`.",
    "Delete the malicious Pinkblocker executable referenced in the hijacked registry key or the Startup folder.",
    "Reboot the machine normally and run a comprehensive anti-malware scan to ensure no secondary droppers are present."
  ],
  "what_to_avoid": [
    "NEVER PAY THE RANSOM. The data is not encrypted, and the screen lock is easily bypassed by a knowledgeable technician.",
    "Avoid reinstalling the entire operating system as a first step; the malware is superficial and data recovery is straightforward."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}