Lorenz

Lorenz is a human-operated ransomware family and extortion operation associated with targeted intrusions against enterprise environments worldwide. It has been linked by multiple researchers to earlier ThunderCrypt and SZ40 code lineage, although operator continuity has not been conclusively established. Lorenz has been used in customized attacks with ransom demands commonly in the hundreds of thousands of dollars and has employed double-extortion tactics by stealing victim data before encryption and threatening public release through a dedicated leak site.

Lorenz intrusions have involved hands-on-keyboard post-compromise activity, including credential harvesting, privilege escalation to local and domain administrator access, lateral movement across Windows networks, and pre-encryption data exfiltration. Observed operator tradecraft includes use of reverse shells and tunneling utilities for pivoting, living-off-the-land commands for discovery, credential dumping from LSASS, remote tasking, and log clearing for defense evasion. In at least one investigated intrusion, the actor gained initial access by exploiting CVE-2022-29499 in a Mitel MiVoice Connect appliance, established persistence with a webshell, tunneled into the internal network, exfiltrated data over SFTP, and then used Microsoft BitLocker at scale for encryption while also deploying Lorenz ransomware to a limited number of ESXi hosts.

The malware encrypts files using symmetric encryption protected by an embedded asymmetric key and has been observed dropping HTML ransom notes and directing victims to dedicated negotiation portals. Samples have been customized per victim organization. Lorenz operators have also advertised stolen data and, in some cases, access to victim networks as part of their extortion model.

A notable implementation flaw in Lorenz’s encryption routine permanently truncates the last 48 bytes of files whose size is an exact multiple of 48 bytes, rendering those bytes unrecoverable even with an attacker-supplied decryptor. Because of this flaw and subsequent reverse engineering, partial recovery has been possible for some victims and certain file types through a public decryptor. Lorenz has primarily been associated with enterprise-focused big-game hunting operations rather than indiscriminate mass campaigns.