Loading threat actor…
CryLock is a ransomware operation associated with Russian cybercriminal activity. It has been identified as one of the more aggressive ransomware groups operating against organizations in Russia and has been linked to affiliate-style operations and data-theft extortion. CryLock has been cited among ransomware programs that ran affiliate programs and among operations that used leak sites or theft of unencrypted files to pressure victims, indicating a ransomware-as-a-service or semi-affiliate operating model. CryLock tradecraft overlaps with later ransomware activity, particularly Trigona. Reported similarities include use of an HTML Application ransom note format and related operational patterns, suggesting that actors previously involved with CryLock may have transitioned to or shared tradecraft with Trigona. CryLock is therefore relevant both as a standalone ransomware family and as part of the broader evolution of Russian-speaking ransomware ecosystems. Law-enforcement action has tied CryLock to Russian nationals. Belgian authorities sentenced a Russian man for developing the ransomware and a Russian woman for advertising it and negotiating with victims, reinforcing attribution to a Russian cybercriminal milieu rather than a state-directed espionage actor. CryLock is best characterized as a financially motivated ransomware threat actor focused on extortion, with known use of stolen-data pressure in addition to file encryption.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned in passing as a ransomware operation that has run an affiliate program.
Ransomware operation; developers/advertisers negotiated with victims and monetized infections at scale.
Mentioned only as one of the most aggressive ransomware groups in Russia in the prior year.
Referenced as a possibly predecessor or overlapping ransomware operation whose operators may have transitioned to Trigona based on shared TTPs and ransom note characteristics.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.