{
  "family": "winlock",
  "sample_count": 20,
  "category": "ransomware",
  "description": "Winlock (historically documented across threat intelligence platforms under designations including Ransom:Win32/Winlock, Trojan-Ransom.Win32.Winlock, and Win32/Winlock) represents a pioneering and destructive screen-locking ransomware family active since 2010. Distributed through compromised adult websites, malicious codec downloads, and drive-by download vectors, Winlock replaces or hooks the Windows graphical shell (explorer.exe), setting itself as the default shell under HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon. Upon execution, Winlock renders a non-dismissible, full-screen lockdown banner that covers the desktop, disables Task Manager, registry editing tools, and task switching keystrokes (Alt+Tab, Ctrl+Alt+Del). The locker displays fake legal notices or pornographic scareware messages demanding SMS premium rate messages or cryptocurrency payment to receive a dynamic unlock code.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Winlock",
    "Trojan-Ransom.Win32.Winlock",
    "Win32/Winlock",
    "Ransom.Winlock",
    "Ransom:Win32/Winlock.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ransom:Win32/Winlock?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Winlock is a landmark screen-locking ransomware family that locks the Windows desktop and demands extortion payment."
      }
    },
    {
      "@type": "Question",
      "name": "How does Winlock hijack the Windows user shell?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the Winlogon Shell registry entry to execute the locker executable instead of explorer.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does Winlock prevent users from closing the extortion screen?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks keyboard combinations like Alt+Tab and Ctrl+Alt+Del while disabling Task Manager via registry policies."
      }
    },
    {
      "@type": "Question",
      "name": "How is Winlock delivered to user computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious media codecs, compromised streaming websites, and exploit kit drive-by downloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can a Winlock ransomware infection be removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into Windows Recovery Environment (WinRE) or Safe Mode with Command Prompt, restore the Winlogon Shell value to explorer.exe, and delete the locker binary."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491.001",
    "T1547.004",
    "T1562.001",
    "T1112",
    "T1189"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Winlock",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Winlock"
    },
    {
      "name": "Kaspersky Lab - Winlock Ransomware Historical Analysis",
      "url": "https://securelist.com/"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom_Winlock",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_winlock"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.004",
      "name": "Boot or Logon Autostart Execution: Winlogon Helper DLL",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Reboot the affected system into Windows Recovery Environment (WinRE) or bootable offline media.",
    "Load the offline SYSTEM and SOFTWARE registry hives using regedit.",
    "Verify and restore HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon 'Shell' to 'explorer.exe'.",
    "Delete the locker binary located in %APPDATA%, %TEMP%, or %WINDIR%.",
    "Remove DisableTaskMgr and DisableRegistryTools policies under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System."
  ],
  "what_to_avoid": [
    "Do not pay the SMS or cryptocurrency ransom demand, as codes provided are rarely functional.",
    "Do not reformat the hard drive before attempting Winlogon shell restoration, as user files remain unencrypted."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Small Business Workstations"
  ],
  "target_geographies": [
    "Global",
    "Eastern Europe",
    "North America"
  ],
  "threat_actors": [
    "Cybercriminal Screen Locker Syndicates"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Extortion & Screen Locker Blackmail",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}