Pony Malware Local Account Brute-Force via LogonUserA

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•5

Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.