{
	"id": "59416f46-47ff-4623-896b-02d20f8ba065",
	"created_at": "2026-05-05T02:45:37.236688Z",
	"updated_at": "2026-05-05T02:46:36.75332Z",
	"deleted_at": null,
	"sha1_hash": "041b3ed128c306bcdc59fcc1ac49d0a9c7454225",
	"title": "PwndLocker Ransomware Gets Pwned: Decryption Now Available",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 957781,
	"plain_text": "PwndLocker Ransomware Gets Pwned: Decryption Now Available\r\nBy Lawrence Abrams\r\nPublished: 2020-03-05 · Archived: 2026-05-05 02:26:50 UTC\r\nEmsisoft has discovered a way to decrypt files encrypted by the new PwndLocker Ransomware so that victims\r\ncan recover their files without paying a ransom.\r\nWe were the first to report about a relatively new ransomware called PwndLocker that was encrypting\r\norganizations and cities around the world and then demanding ransoms ranging from $175,000 to over $660,000\r\ndepending on the size of the network. \r\nPwndLocker Ransom Note\r\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 1 of 8\n\nAmong these victims is Lasalle County, Illinois who was hit with a 50 bitcoin ransom ($442,000) and the City of\r\nNovi Sad, Serbia who had over 50TB of data encrypted.\r\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 2 of 8\n\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 3 of 8\n\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 4 of 8\n\nVisit Advertiser websiteGO TO PAGE\r\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 5 of 8\n\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 6 of 8\n\nFlaw found in ransomware\r\nAfter analyzing the PwndLocker ransomware, Emsisoft's Fabian Wosar was able to spot a weakness in the\r\nmalware that allows victims to recover their files without paying the ransom.\r\nTo receive help with the ransomware, Wosar told BleepingComputer that victims need to send him a copy of the\r\nransomware executable that was used in the attack.\r\nUnfortunately, after deploying the ransomware the attackers are deleting this executable.\r\nVictims may be able to recover the executable using Shadow Explorer or file recovery tools. When searching for\r\nthe executable, victims should look in the %Temp%, C:\\User folders, and %Appdata% folders.\r\nOnce an executable is found, victims can contact Emsisoft to receive help. \r\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 7 of 8\n\n99% of What Mythos Found Is Still Unpatched.\r\nAI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits\r\nis coming.\r\nAt the Autonomous Validation Summit (May 12 \u0026 14), see how autonomous, context-rich validation finds what's\r\nexploitable, proves controls hold, and closes the remediation loop.\r\nClaim Your Spot\r\nSource: https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nhttps://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/\r\nPage 8 of 8",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/pwndlocker-ransomware-gets-pwned-decryption-now-available/"
	],
	"report_names": [
		"pwndlocker-ransomware-gets-pwned-decryption-now-available"
	],
	"threat_actors": [],
	"ts_created_at": 1777949137,
	"ts_updated_at": 1777949196,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/041b3ed128c306bcdc59fcc1ac49d0a9c7454225.pdf",
		"text": "https://archive.orkl.eu/041b3ed128c306bcdc59fcc1ac49d0a9c7454225.txt",
		"img": "https://archive.orkl.eu/041b3ed128c306bcdc59fcc1ac49d0a9c7454225.jpg"
	}
}