At the beginning of March 2020, the National CERT warned all users of the current ransomware attack named PwndLocker, targeting, among other, the operation of some of the municipal administrations on the territory of the Republic of Serbia. The analysis revealed that PwndLocker contains the vulnerability used to unlock all data that have been locked.

The National CERT would therefore like to inform all citizens, businesses and government entities that a new type of ransomware has been created under the name ProLock, which is an improved version of PwndLocker. ProLock does not contain the above vulnerability and, if successfully distributed within information systems or computers, it can cause considerable damage in the infected environment.

The global emergency caused by the spread of COVID-19 has lead to the increased online activity worldwide, for the purpose of which many open RDP ports became suspected to be points of entry for this type of attack.

The National CERT recommends that all users apply enhanced existing measures of prevention and protection published on March 4, 2020 to protect their systems or initiate recovery steps if targeted. It is advised to create backup copies of all important data, to minimize damage in case of a successful attack.