---
title: PlayBoy Locker Ransomware
url: https://www.broadcom.com/support/security-center/protection-bulletin/playboy-locker-ransomware
description: PlayBoy Locker Ransomware
---

# PlayBoy Locker Ransomware

March 26, 2025

PlayBoy Locker is a ransomware variant discovered last September and initially distributed in form of a Ransomware-as-a-Service (RaaS) offering. The ransomware platform offered multi-OS support including Windows, NAS and ESXi operating systems. Later in November, reports emerged that the full source code of the Playboy Locker ransomware was offered for sale, possibly enabling its acquisition by other threat actors. PlayBoy Locker encrypts user data and appends .PLBOY extension to the locked files. The malware has also capabilities to delete the Volume Shadow Copies on the infected endpoints. The observed ransom note was dropped in form of a text file called "INSTRUCTIONS.txt" with attackers advising the victims to contact them regarding ransom demands and further instructions.

Symantec protects you from this threat, identified by the following:

**Adaptive-based**
- ACM.Untrst-RunSys!g1

**Carbon Black-based**
- Associated malicious indicators are blocked and detected by existing policies within VMware Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from VMware Carbon Black Cloud reputation service.

**File-based**
- Trojan.Gen.MBT
- WS.Malware.1

**Machine Learning-based**
- Heur.AdvML.A!300
- Heur.AdvML.A!400
- Heur.AdvML.A!500
- Heur.AdvML.B!100
- Heur.AdvML.B!200