Loading story…
The Lorenz ransomware operation emerged as an enterprise-focused threat using double extortion: attackers stole unencrypted data before encrypting systems, then pressured victims by publishing stolen files on a leak site and, in some cases, offering both the data and internal network access for sale. Reported ransom demands ranged from $500,000 to $700,000, with victims directed to a dedicated Tor payment portal featuring Bitcoin payment instructions and live chat. Researchers said the malware appears linked to earlier ThunderCrypt and SZ40 ransomware, though it remained unclear whether the same operators were involved or whether code had been reused.
Analysis of the malware showed it uses AES encryption with an embedded RSA key, appends the .Lorenz.sz40 extension to encrypted files, and drops a ransom note named HELP_SECURITY_EVENT.html. A later breakthrough by Tesorion led to a free decryptor being added to the NoMoreRansom project, allowing recovery of some files without paying. The researchers found a flaw in Lorenz’s encryption routine that irreversibly destroys the last 48 bytes of files whose size is a multiple of 48 bytes, meaning some data remains corrupted even if decrypted, while other file types such as Microsoft Office documents, PDFs, and some images and videos can be recovered in certain cases.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Arctic Wolf Labs reported additional Lorenz intrusions, including at least one late-2022 case where the attackers exploited CVE-2022-29499 on exposed Mitel MiVoice appliances, later regained access with compromised VPN credentials, and adapted their tactics after earlier activity was blocked. The report said Lorenz used Magnet RAM Capture on a Mitel Digital Voicemail server to dump physical memory and bypass EDR, which Arctic Wolf described as the first publicly documented Lorenz case using that tool.
Researchers said the Lorenz ransomware gang began operating in the month before the May 2021 report, conducting customized intrusions against organizations worldwide. The operation used double extortion, stealing data before encryption and publishing victims on a leak site.
By the time of The Record's report, the Lorenz gang's dark web leak site listed 13 victims. The article said the ransomware had been used exclusively against enterprise targets in its most recent form.
After Tesorion released its tool, the Lorenz decryptor was added to the NoMoreRansom project. The tool was described as non-universal, working only for some file types and cases.
Tesorion researcher Gijs Rijnders reported that Lorenz contains a bug that permanently destroys the last 48 bytes of files whose size is a multiple of 48 bytes. Because of this flaw, some files are unrecoverable even with a decryptor from the attackers, while some non-corrupted files can still be decrypted.
Tesorion released a free decryptor for some Lorenz ransomware victims and announced it in a blog post. The tool was intended to help recover certain encrypted files without paying the ransom.
At the time of BleepingComputer's reporting, Lorenz's leak site listed 12 victims, with data already released for 10 of them. The article also described the gang's practice of selling stolen data and even access to victims' internal networks.
Security researchers assessed that the Lorenz encryptor appears to be the same as or evolved from the earlier ThunderCrypt and SZ40 ransomware families. The reporting noted uncertainty over whether this reflected the same operators or reuse of source code.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
arcticwolf.com
Open sourcenews.sophos.com
Open sourcetrendmicro.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Emsisoft disclosed a weakness in **PwndLocker** ransomware that allows victims to recover encrypted files without paying, offering a free decryption path for organizations hit by the malware. The ransomware had targeted municipalities, government services, and enterprises in the United States and Europe, with reported ransom demands ranging from **$175,000 to more than $660,000**; named victims included **LaSalle County, Illinois**, which reportedly faced a **50 bitcoin** demand, and the **City of Novi Sad, Serbia**, where more than **50 TB** of data was encrypted. PwndLocker, also tracked in some cases as **KeyLocker**, typically used the ransom note `H0w_T0_Rec0very_Files.txt`, appended extensions such as `.pwnd` and `.key`, and threatened to leak stolen data while increasing the ransom over time. Researchers said victims need a copy of the ransomware executable used in the attack to enable recovery, even though operators often delete it after deployment; potential recovery locations include `%Temp%`, `C:\User`, and `%AppData%`, and the file may also be recoverable through Shadow Explorer or file recovery tools. Separate reporting also noted a flaw in the attackers’ own decryptor that could fail on files larger than **64 MB**, meaning some victims might not have been able to fully restore data even after paying.
Aug 15, 2026
The **Clop** ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to **TA505**, describing attacks in which operators used tools such as **Cobalt Strike** and **Mimikatz**, encrypted files with `.Clop` or `.CIop` extensions, and disrupted business operations at victims including **E-Land Group**, **Software AG**, and reportedly **Indiabulls Group**. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to **double extortion** and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as **`CVE-2023-0669`** in **Fortra GoAnywhere MFT**, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the **U.S., Canada, Peru, China, Taiwan, and Europe** across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 15, 2026
**Ranzy Locker** emerged as a ransomware-as-a-service operation and a rebranded successor to **ThunderX**, with some code and infrastructure overlap also linked to **Ako**. Researchers reported that the group adopted **double extortion**, stealing data before encrypting systems and threatening to publish it on the **"Ranzy Leak"** site if victims refused to pay. The malware used **Salsa20** file encryption with **RSA-2048**-protected keys, appended extensions such as `.ranzy` and `.RNZ`, and directed victims to ransom notes and a **Tor-based** payment and support portal. Reporting tied Ranzy intrusions to phishing, exploitation of **Microsoft Exchange**, and abuse of **RDP** valid accounts and brute-force access. Once inside a network, the malware enumerated local and network drives, discovered shares, accessed credentials, deleted backups and shadow copies, and disabled recovery options to increase pressure on victims. An FBI flash report cited in one analysis said the gang had compromised more than **30 U.S. businesses** across multiple sectors by July 2021, and researchers noted that no public decryptor was available at the time despite detailed mapping of the group's tactics to the **MITRE ATT&CK** framework.
Aug 15, 2026