Lorenz

Lorenz is a human-operated ransomware and extortion group associated with customized intrusions against enterprise organizations worldwide. The operation emerged in 2021 and has been linked by researchers to code overlap or lineage with the older ThunderCrypt and SZ40 ransomware families, although operator continuity has not been established with high confidence. Lorenz has used a double-extortion model, stealing data before encryption and pressuring victims through a dedicated leak site. The group has also advertised stolen data and, in some cases, offered access to victim networks for sale. Lorenz has conducted targeted intrusions rather than indiscriminate mass campaigns. Reported tradecraft includes exploitation of internet-exposed edge infrastructure for initial access, notably CVE-2022-29499 affecting Mitel MiVoice Connect appliances, followed by reverse-shell access, tunneling with Chisel, credential harvesting, and lateral movement. Observed post-compromise activity includes LSASS dumping, use of CrackMapExec and lsassy, account creation for persistence, RDP-based movement, network and Active Directory discovery, and extensive living-off-the-land activity. In one documented intrusion, the group adapted after defensive interference, later regaining access through compromised VPN credentials associated with a third-party vendor account. For defense evasion and post-exploitation, Lorenz has abused legitimate tools as well as native administrative mechanisms. Documented behavior includes use of Magnet RAM Capture to dump physical memory and bypass endpoint protections through its signed kernel driver, clearing Windows event logs, and staging activity through scheduled tasks and remote administration workflows. Data theft has been observed via FileZilla over SSH/SFTP. Lorenz has used multiple impact mechanisms. In Windows environments, the group has deployed BitLocker at scale through PowerShell and scheduled tasks; in some cases it also deployed Lorenz ransomware to ESXi hosts. The ransomware operation is known for high-value ransom demands in the hundreds of thousands of dollars. A flaw in the Lorenz encryption routine enabled development of a partial decryptor for some file types, though recovery is not universal and some encrypted files remain irreparably damaged. Known aliases and related names include Lorenz and references connecting the malware lineage to ThunderCrypt and SZ40.