GwisinLocker Ransomware Exclusively Takes Aim at South Korean Organizations

The GwisinLocker ransomware is able to operate in safe mode, it first copies itself to a certain path of ProgramData and then is registered as a service before forcing a system reboot.