Lorenz ransomware targets enterprises as free decryptor exposes encryption flaw

The Lorenz ransomware operation emerged as an enterprise-focused threat using double extortion: attackers stole unencrypted data before encrypting systems, then pressured victims by publishing stolen files on a leak site and, in some cases, offering both the data and internal network access for sale. Reported ransom demands ranged from $500,000 to $700,000, with victims directed to a dedicated Tor payment portal featuring Bitcoin payment instructions and live chat. Researchers said the malware appears linked to earlier ThunderCrypt and SZ40 ransomware, though it remained unclear whether the same operators were involved or whether code had been reused.

Analysis of the malware showed it uses AES encryption with an embedded RSA key, appends the .Lorenz.sz40 extension to encrypted files, and drops a ransom note named HELP_SECURITY_EVENT.html. A later breakthrough by Tesorion led to a free decryptor being added to the NoMoreRansom project, allowing recovery of some files without paying. The researchers found a flaw in Lorenz’s encryption routine that irreversibly destroys the last 48 bytes of files whose size is a multiple of 48 bytes, meaning some data remains corrupted even if decrypted, while other file types such as Microsoft Office documents, PDFs, and some images and videos can be recovered in certain cases.