ATT&CKing ProLock Ransomware

ProLock ransomware, active since March 2020 as a successor to PwndLocker, targets enterprise organizations (financial, healthcare, government, retail) using QakBot and exposed/weak RDP for initial access. Operators use PowerShell to extract and run payloads in memory, employ credential dumping and lateral movement (PsExec, WMIC, RDP), archive and exfiltrate data with 7Zip and Rclone, then deploy ProLock enterprise-wide to encrypt files (adding .proLock/.pr0Lock/.proL0ck extensions) and demand large ransoms (examples include embedded 35 BTC demands). The report includes MITRE ATT&CK mappings, sample commands/scripts, and mitigation guidance.