Lock Like a Pro

This report analyzes the ProLock ransomware campaign, outlining how operators leverage Qakbot (and sometimes Emotet) for initial access via phishing and weaponized documents, perform AD reconnaissance (BloodHound/Sharphound, ADFind), lateral movement (PsExec, RDP), and deploy ProLock while exfiltrating data with Rclone and disabling defenses; the group targets large enterprises (Big Game Hunting) with high ransom demands (tens to hundreds of BTC).