{
  "family": "winlock",
  "sample_count": 20,
  "category": "ransomware",
  "description": "Ransomware:Win32/Winlock represents one of the earliest and most historically significant families of ransomware. Unlike modern crypto-ransomware that encrypts files, Winlock (originating largely from Russia in the late 2000s) acts as a 'Screen Locker'. It completely disables the Windows graphical user interface, locking the user out of their machine and demanding payment (historically via premium-rate SMS messages) to restore access.<br><br><b>Understanding Winlock</b><br>To the victim, a Winlock infection is terrifying and immediate. The computer boots, but instead of the Windows desktop, a full-screen, unclosable window appears. This window often displays highly explicit imagery or fake law enforcement warnings (e.g., 'FBI Anti-Piracy Warning'), demanding a fine be paid. For a security analyst, Winlock represents the chaotic evolution of digital extortion before the widespread adoption of Bitcoin and strong cryptography.<br><br><b>Execution and GUI Subversion</b><br>Winlock was primarily distributed via drive-by downloads or bundled with pirated software (`T1189`). Upon execution, it does not encrypt files. Instead, it alters critical Windows Registry keys. It modifies the `Shell` value under `Winlogon` (which normally points to `explorer.exe`) to point to the malware executable (`T1547.004`). When the user logs in, the malware loads instead of the desktop. It aggressively hooks keyboard inputs (`T1056.001`) to disable `Ctrl+Alt+Del`, `Alt+Tab`, and the Windows key, ensuring the user cannot bypass the lock screen. It also attempts to disable booting into Safe Mode (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of system availability. However, the underlying data remains intact. EDR platforms detect the unauthorized modification of the `Winlogon\\Shell` registry key. Because the lock screen prevents any local triage, incident responders must approach the machine out-of-band.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1056.001",
    "T1189",
    "T1547.004",
    "T1562.001",
    "T1491"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Do not pay the ransom. Winlock relies on intimidation; the underlying files are not encrypted and can be recovered.",
    "Attempt to boot the machine into 'Safe Mode with Command Prompt'. If successful, use `regedit` to manually restore the `Winlogon\\Shell` key to `explorer.exe`.",
    "If Safe Mode is disabled by the malware, boot the system using a clean, offline recovery environment (e.g., Windows PE or a Linux Live USB).",
    "From the offline environment, mount the Windows Registry, correct the hijacked `Shell` value, and delete the malware executable from the disk."
  ],
  "what_to_avoid": [
    "Do not format the hard drive; unlike crypto-ransomware, Winlock does not destroy data, it merely hides the UI.",
    "Avoid paying the premium SMS or entering voucher codes; there is no guarantee the attackers will provide an unlock code."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}