PlikanLocker: A Technical Teardown of File Locking with Telegram-Based Exfiltration

PlikanLocker is a .NET-based locker malware that aggressively locks user files with AES encryption, disables system defenses, and exfiltrates victim data—including screenshots and metadata—directly to the attacker via Telegram, all while blocking user access with a retro-styled fullscreen ransom note.