CyberLock
CyberLock is a Windows ransomware family reported by Cisco Talos in campaigns that masqueraded as legitimate AI tool installers. It was distributed via SEO poisoning and a fake NovaLeads AI website at novaleadsai[.]com impersonating the legitimate novaleads.app service, with activity observed as early as February 2025. The lure targeted users and organizations seeking AI solutions, with Talos specifically noting elevated risk to businesses in B2B sales, technology, and marketing sectors.
In the observed infection chain, victims downloaded a ZIP archive containing a .NET executable named NovaLeadsAI.exe, compiled on February 2, 2025. That executable functioned as a loader for an embedded CyberLock PowerShell ransomware script. CyberLock is written in PowerShell with embedded C# code, hides its console window using GetConsoleWindow and ShowWindow, and can elevate privileges and re-execute itself with administrative rights.
Once executed, CyberLock enumerates files on the C:, D:, and E:\ logical partitions and encrypts targeted files with AES. It appends the .cyberlock extension to encrypted files. Talos reported that it targets a broad range of file types, including documents, spreadsheets, presentations, PDFs, images, audio, video, archives, executables, source code, databases, configuration files, fonts, design files, backups, GIS files, and other data files. It drops a ransom note named ReadMeNow.txt on the victim desktop and changes the desktop wallpaper by downloading an image and setting the Wallpaper registry key.
CyberLock also uses the Windows LOLBin cipher.exe with the /w option to wipe free space on hard drive partitions, hindering forensic recovery. The ransom note instructed victims to contact cyberspectreislocked@onionmail[.]org and demanded $50,000 payable in Monero (XMR). The note claimed the funds would support humanitarian aid and threatened to expose stolen data within three days, but Talos found no evidence in the ransomware code of data exfiltration capability.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Threat actors are employing a variety of techniques and channels to distribute these fraudulent installers, including SEO-poisoning tactics to manipulate search engine rankings and cause their malicious websites or download links to appear at the top of search engine results.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
4 techniques
Stealth
The ‘NovaLeadsAI.exe’ file is the loader that has the CyberLock ransomware PowerShell script embedded as the resource file.
Cisco Talos has discovered new threats, including the ransomware CyberLock, Lucky_Gh0$t, and a newly-discovered malware we call “Numero,” all of which masquerade as legitimate AI tool installers.
Defense Impairment
1 technique
Defense Impairment
Discovery
1 technique
Discovery
Collection
1 technique
Collection
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows ransomware delivered through a fake NovaLeads AI site; described as PowerShell-based and demanding a $50K Monero ransom.
PowerShell-developed ransomware family distributed via fake AI tool installers; encrypts selected files on victim systems.
PowerShell-based ransomware delivered via a .NET loader masquerading as an AI tool installer. It encrypts files with AES, appends the .cyberlock extension, drops a ransom note, changes the desktop wallpaper, and uses cipher.exe /w to wipe free space and hinder forensic recovery.
Ransomware distributed via fake AI tool installers, encrypting files and demanding payment from victims.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.