Loading malware…
Lorenz is a ransomware family associated with a financially motivated, human-operated extortion operation first observed in February 2021. Its operators conduct customized intrusions against organizations worldwide, including healthcare, public-sector, and industrial organizations. Attacks have affected Windows environments and VMware ESXi hosts. The operation combines encryption with data theft, threatening public disclosure and offering stolen databases and compromised network access for sale. Reported ransom demands have commonly ranged from $500,000 to $700,000.
Lorenz intrusions have exploited CVE-2022-29499 in internet-facing Mitel MiVoice Connect appliances. Attackers establish persistent web shells and use reverse shells and Chisel tunnels to access internal networks. Existing backdoors have remained usable after vulnerable systems were patched, with some intrusions involving months between initial compromise and ransomware deployment. Operators perform network and Active Directory discovery, extract credentials from LSASS, obtain administrator privileges, and move laterally using tools such as CrackMapExec and RDP. Observed attacks exfiltrated data using FileZilla over SFTP and suppressed appliance logging or cleared Windows event logs to hinder investigation.
The Lorenz encryptor uses AES for file encryption and an embedded RSA key to protect the AES key. Its encryptor shares code with ThunderCrypt. In addition to deploying Lorenz ransomware, operators have used remotely scheduled PowerShell scripts to enable Microsoft BitLocker across Windows endpoints. Stolen data is used for staged extortion: operators may offer it for sale, publish password-protected archives, and ultimately release archive passwords publicly.
Tesorion released a free decryptor through the No More Ransom project in June 2021, but recovery is limited to certain files and variants. Encryption defects in analyzed versions can irreversibly discard file data or prevent successful recovery even by the attackers.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
We found that multiple POST requests to this web shell had taken place in the 48 hours prior to the detonation of Lorenz ransomware.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.