Loading threat actor…
MorLock is a threat actor associated with ransomware campaigns targeting Russian organizations. Its toolkit includes LockBit 3.0 and Babuk ransomware, XenAllPasswordPro for credential harvesting, SoftPerfect Network Scanner and PingCastle for network and Active Directory reconnaissance, and resocks for proxy-based remote access. Its operations have used Surfshark VPN and VDSina-hosted infrastructure. MorLock exhibits technical and infrastructure overlaps with Crypt Ghouls, including shared ransomware families, credential-harvesting tools, proxy utilities, and similar tool-deployment naming conventions. These overlaps do not establish that the two are the same actor. MorLock's country of origin, organizational structure, and dominant motivation are not established.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
6 malware families Mallory has associated with this actor across public reporting.
1 additional family tracked in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.