{
  "family": "pinkblocker",
  "sample_count": 3,
  "category": "ransomware",
  "description": "Ransom:Win32/Pinkblocker is a highly disruptive, screen-locking extortion trojan. Unlike cryptographic ransomware (which encrypts files), Pinkblocker operates by aggressively hijacking the Windows user interface, preventing all interaction with the desktop, taskbar, and applications, and demanding a ransom payment to restore access to the computer.<br><br><b>Understanding Pinkblocker (Screen Locker)</b><br>To an end-user, the infection is terrifying: upon booting the computer or executing a malicious file, the screen goes entirely pink (or displays a threatening ransom note), and neither the mouse nor keyboard shortcuts (like Ctrl+Alt+Del) seem to function. For a security analyst, Pinkblocker is generally considered a lower-tier threat than crypto-ransomware because the underlying user data (`T1486`) is not actually destroyed or encrypted; the malware merely blocks access to the operating system shell (`T1491.001`).<br><br><b>Execution and Locking Mechanics</b><br>Pinkblocker is typically distributed via malicious links, fake software cracks, or malspam (`T1204.002`). Upon execution, it establishes intense persistence, often overwriting the default Windows Shell (`explorer.exe`) in the registry (`HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell`) (`T1547.004`). When the user logs in, instead of loading the desktop, Windows loads the Pinkblocker interface. The malware frequently utilizes hooking techniques (`T1056.002` - applied to input blocking) to intercept and suppress critical keystrokes like the Windows key, Alt+Tab, and Ctrl+Alt+Del, locking the user into the ransom screen.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of productivity and severe denial of service to the affected endpoint, though the data remains intact. Host-based IoCs include the modification of the `Winlogon\\Shell` registry key, the presence of the blocking executable in the Startup folder, and the overt, inescapable pink screen demanding payment.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Pinkblocker and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pinkblocker is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pinkblocker establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pinkblocker typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Pinkblocker compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Pinkblocker should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Pinkblocker employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pinkblocker typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Pinkblocker, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Pinkblocker depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.004",
    "T1056.002",
    "T1491.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement (Screen locking)",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL (Shell Hijacking)",
      "tactic": "Persistence"
    },
    {
      "id": "T1056.002",
      "name": "Input Capture: GUI Input Capture (Blocking keyboard shortcuts)",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Hard reboot the infected machine into 'Safe Mode with Command Prompt' (which often bypasses the Winlogon Shell hijack).",
    "Use the command-line Registry Editor (`regedit`) to navigate to `HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon` and change the `Shell` value back to `explorer.exe`.",
    "Delete the malicious Pinkblocker executable referenced in the hijacked registry key or the Startup folder.",
    "Reboot the machine normally and run a comprehensive anti-malware scan to ensure no secondary droppers are present."
  ],
  "what_to_avoid": [
    "NEVER PAY THE RANSOM. The data is not encrypted, and the screen lock is easily bypassed by a knowledgeable technician.",
    "Avoid reinstalling the entire operating system as a first step; the malware is superficial and data recovery is straightforward."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}