Ransomware Group intelligence
AiLock
ActiveTrack AiLock with 63 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
AiLock is tracked by Breach House as a ransomware group with 63 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 52m ago | dhnsppqjaaa22lsqxl2tfhji4ca43743kubltnodvsft3hkvai77p6ad.onion |
Top Activity Sectors (15)
- Manufacturing / Engineering 11
- Services 9
- IT 6
- Communication / Marketing 6
- Telecommunications 3
- Finance / Legal / Insurance 2
- Construction / Real Estate 2
- Retail / E-commerce 2
- Agriculture / Food 2
- Healthcare / Pharma 2
- Transportation / Travel / Logistics 1
- Hospitality / Food & Beverage / Tourism 1
- Education 1
- Not identified 1
- Energy 1
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue AiLock, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: AiLock executes PowerShell scripts to stage payloads and disable security tools on compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: AiLock disables antivirus and monitoring tools by terminating processes and modifying service configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: AiLock deletes Volume Shadow Copies and backup directories via command-line utilities to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1049 System Network Connections Discovery Discovery
What they do: AiLock discovers active network connections to identify high-value servers and data repositories.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1135 Network Share Discovery Discovery
What they do: AiLock scans network shares using SMB tools to identify additional victim machines for lateral movement.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: AiLock propagates laterally across Windows networks by accessing SMB administrative shares.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: AiLock exfiltrates stolen data through encrypted C2 channels before deploying ransomware.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: AiLock encrypts victim files using custom symmetric encryption routines targeting critical business data.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
ReadMe[1].txt
Hello, The key data points of your network has been compromised, and all of your company's critical data has been transferred to our secure systems. Positive News: - We are capable of fully restoring your systems and data. - If we come to an agreement, this incident will remain confidential between your organization and our team. - Our motivation is purely financial, and we do not align with any specific country or political ideology Terms and Conditions: 1) You must contact us within 72 hours; otherwise, we will publish an announcement about the leak of your data. 2) You have 5 days to reach an agreement; If you fail to do so, your data will be published and the recovery tool destroyed. To initiate the negotiation process, please proceed with the following steps: 1) Download the Tor Browser from it's official website: https://www.torproject.org/ 2) Use the provided credentials to log into the Chat for text-based negotiations: http://[snip]qs6wu56n2adj7qrjg25dhcux2nislvjouffpzldj23e4y72akoid.onion/[snip] We all understand what happened and what consequences await you. All countries have their own PDPL (Personal Data Protection Law) regulations. In the event that you do not agree with us, information pertaining to your companies and the data of your company's customers will be published on the internet, and the respective country's personal data usage authority will be informed. Moreover, confidential data related to your company will be shared with potential competitors through email and social media. You can be sure that you will incur damages far exceeding the amount we are requesting from you should you decide not to agree with us. What we offer in exchange for your payment: - Full decryption and restoration of systems and data following an incident, completed within 24 hours. - We guarantee that all recovered data will remain confidential and that all of your leaked data will be securely deleted from our servers after resolving the incident. We will provide a full deletion log. - Expert advice tailored to strengthen your company's IT infrastructure against future threats. Useful tips that will help you : 1) Do not try to recover files yourself. 2) Do not modify encrypted files. 3) Do not use third party software to restore your data.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (63)
Search, filter and paginate the victim timeline for AiLock. Showing 1–63 of 63.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Morgan Services id32136 View details | United Kingdom | Services | — | |
|
morganservices.com operates within the Services sector and is situated in the United Kingdom. The entity represents a business organization whose security posture was impacted by a ransomware incident. This listing identifies morgorservices.com specifically as a ransomware victim linked to the threat actor AiLock. The index aggregates such intelligence to help security professionals understand affected organizations, threat actor targeting patterns, and sector-specific exposure. Details regarding the nature of the compromise remain limited to the verified classification of this entity as a victim associated with AiLock. |
|||||
| Ransomware | Morgan Services id32136 View details | United Kingdom | Services | — | |
|
Morgan Services, Inc. is a family-owned textile company in business since 1887, they specialize in linen and uniform rental services for all types of facilities. Morgan is headquartered in Chicago, Illinois. |
|||||
| Ransomware | Hamilton id32137 View details | United States | Services | — | |
|
hamiltoncompany.com operates within the Services sector based in the United States, providing business and professional services to clients and partners. The entity is cataloged in this threat-intelligence index under the listing type ransomware victim, specifically linked to the threat actor AiLock. This classification reflects the cybersecurity context in which the organization was identified within the index's monitoring framework. No specific incident details, such as data stolen, ransom demands, or breach confirmation, are included here to maintain factual neutrality and avoid speculation beyond the verified association. The entry serves to document the relationship between hamiltoncompany.com and AiLock within the ransomware victim category for threat intelligence purposes. |
|||||
| Ransomware | Hamilton id32137 View details | United States | Services | — | |
|
Founded in 1953 and headquartered in Reno, Nevada, Hamilton Company is a global provider in the design and manufacture of liquid handling, process measurement, robotics and automated storage solutions, serving customers in academic and private research laboratories, pharmaceutical and clinical diagnostic companies and government institutions. |
|||||
| Ransomware | DAISEN id31659 View details | Japan | Manufacturing / Engineering | — | |
|
Daisen Co Ltd is a Japanese company operating in the manufacturing and engineering sector. The company is based in Japan and provides various products and services related to its sector. Daisen Co Ltd was listed as a ransomware victim associated with AiLock |
|||||
| Ransomware | DAISEN id31659 View details | Japan | Manufacturing / Engineering | — | |
|
DAISEN is a leading manufacturer specializing in greenhouses, vinyl houses, and daylight architecture. |
|||||
| Ransomware | Yaomasa id31660 View details | Japan | Manufacturing / Engineering | — | |
|
Yaomasa.com is a Japanese company operating in the manufacturing and engineering sector. The company is based in Japan and provides various products and services related to its sector. Yaomasa.com was listed as a ransomware victim associated with AiLock. |
|||||
| Ransomware | Yaomasa id31660 View details | Japan | Manufacturing / Engineering | — | |
|
Yaomasa is a Japanese supermarket chain founded in 1919 that offers fresh foods, general groceries, and daily necessities, while also operating TSUTAYA and BOOKOFF franchise stores as part of its cultural division. |
|||||
| Ransomware | Nihon Kotsu Co., Ltd. id30572 View details | Japan | Transportation / Travel / Logistics | — | |
|
Nihon-kotsu.co.jp is a Japan-based company operating in the transportation sector, providing travel and logistics services. The company is involved in various aspects of transportation, including bus operations and travel planning. Nihon-kotsu.co.jp was listed as a ransomware victim associated with AiLock |
|||||
| Ransomware | Nihon Kotsu Co., Ltd. id30572 View details | Japan | Transportation / Travel / Logistics | — | |
|
Nihon Kotsu Co., Ltd. is the largest taxi and limousine operator in Japan. For the fiscal year ending May 2025, the company reported an annual consolidated revenue of ¥103.445 billion, with group and partner company sales reaching ¥155.457 billion. |
|||||
| Ransomware | Solid Advance Inc. id30573 View details | Japan | Finance / Legal / Insurance | — | |
|
Solid-adv.co.jp is a Japanese company operating in the finance, legal, and insurance sector, providing various services to its clients. The company is based in Japan and offers a range of financial and legal solutions. Solid-adv.co.jp was listed as a ransomware victim associated with AiLock. |
|||||
| Ransomware | Solid Advance Inc. id30573 View details | Japan | Finance / Legal / Insurance | — | |
|
Solid Advance Inc. is a Japanese software company, founded in 2004, based in Tokyo and Aomori. It develops and sells All Gather CRM, a fully in-house-built, integrated CRM package covering customer management, sales support (SFA), marketing, and call centers, available both in the cloud and on-premise. The company also provides network and cybersecurity services, including LAN/WAN design and security infrastructure. |
|||||
| Ransomware | Ferrovial id30574 View details | Spain | Construction / Real Estate | — | |
|
Ferrovial.com is a leading Spanish multinational company specializing in the construction and real estate sectors. Headquartered in Spain, Ferrovial.com operates globally, offering a range of services including infrastructure development, construction, and real estate management. Ferrovial.com is known for its involvement in various high-profile projects across the globe. It was listed as a ransomware victim associated with AiLock |
|||||
| Ransomware | Ferrovial id30574 View details | Spain | Construction / Real Estate | — | |
|
Headquartered in Ferrovial operates as a global infrastructure and mobility operator. The company's services include the design and construction of public and private projects, and development, finance, and operation of toll road concessions. |
|||||
| Ransomware | WBF Construction id30547 View details | Canada | Construction / Real Estate | — | |
|
WBF Construction is a company operating in the construction and real estate sector, based in Canada. The company likely provides various construction services, including building and development projects. WBF Construction was listed as a ransomware victim associated with AiLock. |
|||||
| Ransomware | WBF Construction id30547 View details | Canada | Construction / Real Estate | — | |
|
WBF Construction LLC is a company that operates in the Commercial & Residential Construction industry. It employs 1to4 people and has under500K of revenue. The company is headquartered in New Haven, Connecticut. |
|||||
| Ransomware | Pinturas Prisa id30370 View details | Mexico | Manufacturing / Engineering | — | |
|
Pinturas Prisa is a company based in Mexico, operating in the manufacturing and engineering sector. The company likely provides various products and services related to painting and coatings. Pinturas Prisa was listed as a ransomware victim associated with AiLock. |
|||||
| Ransomware | Pinturas Prisa id30370 View details | Mexico | Manufacturing / Engineering | — | |
|
Pinturas PRISA is a Mexican company from the state of Jalisco with nearly 80 years of history, specializing in the production of high-quality paints and coatings for industrial sectors (automotive, woodworking, manufacturing) and retail customers. |
|||||
| Ransomware | Studio Sardano id30311 View details | Italy | Hospitality / Food & Beverage / Tourism | — | |
|
Studiosardano-riccione.com is a hospitality company based in Italy, operating in the tourism sector, likely offering accommodations and related services. The company is part of the food and beverage industry, catering to tourists in the Riccione area. Studiosardano-riccione.com was listed as a ransomware victim associated with AiLock |
|||||
| Ransomware | Studio Sardano id30311 View details | Italy | Hospitality / Food & Beverage / Tourism | — | |
|
Studio Sardano is a company that operates in the Repair Services industry. It employs 10to19 people and has 1Mto5M of revenue. The company is headquartered in Riccione, Emilia-Romagna, Italy. |
|||||
| Ransomware | Richmont Graduate University id30312 View details | United States | Education | — | |
|
Richmont University is a private university located in the United States, offering various academic programs in the education sector. The university provides higher education to students, focusing on academic excellence and personal growth. Richmont University was listed as a ransomware victim associated with AiLock. |
|||||
| Ransomware | Richmont Graduate University id30312 View details | United States | Education | — | |
|
Richmont Graduate University is a Christian graduate institution offering master's programs in counseling and ministry, available both online and on-campus. |
|||||
| Ransomware | Hokua id30041 View details | Chile | — | — | |
|
Hokua.net is a Chilean entity, presumably operating in the technology or internet services sector, given its .net domain. The company's specific offerings and services are not well-documented. Hokua.net was listed as a ransomware victim associated with AiLock. |
|||||
| Ransomware | Hokua id30041 View details | Chile | — | — | |
|
Hokua Suites is a luxury resort-style residential condominium located in Honolulu, Hawaii. The complex offers upscale apartments with ocean views and a full range of premium amenities. |
|||||
| Ransomware | Röben Tonbaustoffe GmbH id29865 View details | Germany | IT | — | |
|
Röben Tonbaustoffe GmbH is the largest private brick manufacturer in Germany, a family-owned business now in its 6th generation. |
|||||
| Ransomware | Groupe Sécurité CLB id29626 View details | France | IT | — | |
|
Groupe Sécurité CLB specializes in providing comprehensive football score tracking and prediction services. Their offerings include historical score queries, live score updates, and match predictions for various leagues, including European and Asian football. |
|||||
| Ransomware | Schneebeli id29537 View details | Switzerland | Manufacturing / Engineering | — | |
|
Schneebeli AG is a Swiss carpentry firm located in Ottenbach, specializing in custom furniture, kitchens, and interior construction tailored to individual client needs. |
|||||
| Ransomware | Restorative Therapies, Inc. id29406 View details | United States | Other | — | |
|
Restorative Therapies was established in 2004 as a partnership between researchers, engineers, and patient advocates to develop and promote Advanced Rehabilitation Technologies (ART). |
|||||
| Ransomware | Artso International, Inc. id29338 View details | Taiwan, Province of China | Manufacturing / Engineering | — | |
|
Artso is a Taiwan-based premium ergonomic furniture brand specializing in SOHO furniture, children's growth desks, and cypress wood home furnishings, operating ~30 counters in major department stores since 2004. |
|||||
| Ransomware | Design Engineering & Consulting id29224 View details | United States | Services | — | |
|
Design Engineering & Consulting provides façade system design, shop drawings, engineering, and consulting services in a cost – effective and professional manner across the world. |
|||||
| Ransomware | Jazz Hipster id29225 View details | United States | Manufacturing / Engineering | — | |
|
Jazz Hipster was established in 1981 as a professional speaker manufacturer responding to market demands and embracing the evolution in technology. |
|||||
| Ransomware | Accretech America Inc. id29042 View details | United States | Manufacturing / Engineering | — | |
|
Accretech America Inc. is the U.S. division of Tokyo Seimitsu Co., Ltd. of Japan, a Japanese corporation specialising in semiconductor equipment and precision instrumentation. |
|||||
| Ransomware | Site Design Group id28328 View details | United States | IT | — | |
|
Site Design Group Ltd. is a Chicago-based firm specializing in landscape architecture and urban design. |
|||||
| Ransomware | Raich Sp. z o.o. id28584 View details | Poland | IT | — | |
|
Raich Sp. z o.o. is an enterprise in Poland, with the main office in Warsaw. The company operates in the Wired Telecommunications Carriers industry. |
|||||
| Ransomware | Mother's Market & Kitchen id28657 View details | United States | Retail / E-commerce | — | |
|
Mother's has gained a reputation for having a wide selection for specialized diets, top quality local and organic produce, the county's largest selection of supplements.The data archive contains personal data of employees: ssn+dob+name+home address+phone |
|||||
| Ransomware | PremCom id28693 View details | United Kingdom | Telecommunications | — | |
|
PremCom is a technology-driven company founded in 1990 that combines expertise in print and direct mail with digital solutions to deliver omnichannel communications. |
|||||
| Ransomware | Alvi Associates id28054 View details | United States | Manufacturing / Engineering | — | |
|
Founded in 1979, Alvi Associates, Inc. specializes in integrated engineering services for infrastructure projects, including structural, water resources, transportation, and geotechnical engineering. |
|||||
| Ransomware | Berning & Söhne GmbH id27851 View details | Germany | Manufacturing / Engineering | — | |
|
Berning Smart Fasteners boasts 120 years of experience in the development, production, and application of metal components and fasteners. |
|||||
| Ransomware | Piet Vijverberg id27850 View details | Netherlands | Agriculture / Food | — | |
|
Piet Vijverberg specializes in the innovative cultivation of colorful Phalaenopsis and Dracaena varieties. |
|||||
| Ransomware | Solutions Extreme Technology id27380 View details | Canada | IT | — | |
|
Solutions Extreme is an IT services company that provides cloud computing, managed services, and business continuity solutions to help businesses maintain reliable operations and protect against data loss. |
|||||
| Ransomware | England Hockey id27282 View details | United Kingdom | Services | — | |
|
England Hockey is the national governing body responsible for the management and development of hockey in England, catering to both grassroots and elite levels.The organization offers a range of services including competitions, events, coaching, and officiating programs. |
|||||
| Ransomware | Johnson Vollmerhausen & Gates id27163 View details | United States | Services | — | |
|
Johnson Vollmerhausen & Gates provides professional accounting, tax, and advisory services tailored to the needs of both individuals and businesses. |
|||||
| Ransomware | Netwerk NV id27162 View details | Belgium | Services | — | |
|
Netwerk NV is part of the Korevaar Group. Their services range from container cleaning to waste management and pest control. |
|||||
| Ransomware | Eeyou Communications Network id27161 View details | Canada | Telecommunications | — | |
|
Eeyou Communications Network operates a regional fibre optic network serving the James Bay and Eeyou Istchee regions, providing ultra-high-speed internet since 2004. |
|||||
| Ransomware | Transsion id27115 View details | China | Communication / Marketing | — | |
|
Transsion Holdings is a diversified international telecommunications manufacturing company founded in 2006, specializing in mobility solutions with operations in over 50 countries globally.The data contains git, git-ai, vendor proprietary code, NDA documents, and other internal documents. |
|||||
| Ransomware | Demanor id27016 View details | Norway | Communication / Marketing | — | |
|
Demanor AS specializes in providing customized goods lifts and lifting machines tailored to the specific needs and conditions of their clients. |
|||||
| Ransomware | Aaronson Rappaport Feinstein & Deutsch id27015 View details | United States | Finance / Legal / Insurance | — | |
|
Aaronson Rappaport Feinstein and Deutsch, LLP is a New York-based law firm that specializes in providing legal services across various practice areas, including medical malpractice, construction litigation, and product liability. |
|||||
| Ransomware | Dallas Regional Chamber id27014 View details | United States | Communication / Marketing | — | |
|
The Dallas Regional Chamber is a prominent business organization known for its role as the economic growth champion and business voice of the Dallas region.It focuses on priorities such as economic development, education, public policy, and quality of life. |
|||||
| Ransomware | ShopBot Tools id27013 View details | United States | Retail / E-commerce | — | |
|
ShopBot Tools is a leading manufacturer of high-quality CNC routers, designed for machining various materials including wood, plastic, and aluminum. |
|||||
| Ransomware | Navicore Solutions id27012 View details | United States | Services | — | |
|
Navicore Solutions strengthens the well-being of individuals and families through education, guidance, advocacy and support. |
|||||
| Ransomware | Professional Retail Outlet Services id27011 View details | United States | Services | — | |
|
PROS specializes in facilities management and maintenance services for specialty retail chains, boasting 20 years of experience. |
|||||
| Ransomware | S&R Compression, LLC id27010 View details | United States | Communication / Marketing | — | |
|
S&R Compression is an oil & energy company offering compression and vapor recovery services. |
|||||
| Ransomware | Emanuelson-Podas id27009 View details | United States | Manufacturing / Engineering | — | |
|
Emanuelson-Podas, Inc. is a mechanical, electrical, and plumbing engineering firm that specializes in creating innovative building system solutions. |
|||||
| Ransomware | ELO Digital Office id27008 View details | Germany | IT | — | |
|
ELO Digital Office, founded in 1996 and headquartered in Stuggart, Germany, is a provider of enterprise content management systems and develops software solutions to digitize business processes. |
|||||
| Ransomware | Promotion Management Center id27007 View details | Japan | Communication / Marketing | — | |
|
Founded in 1983, Promotion Management Center, Inc. (PMC) provides fulfillment services.The company specializes in customer incentives, loyalty rewards, employee recognition awards, rebates and third party logistics (3PL) orders your programs generate. |
|||||
| Ransomware | Sterling Industries id27006 View details | United States | Healthcare / Pharma | — | |
|
Sterling Industries is a North American-based contract manufacturer and assembler of medical devices and sub-components. |
|||||
| Ransomware | Raw Seafoods id27005 View details | United States | Agriculture / Food | — | |
|
Raw Seafoods, Inc. is a family owned and operated company in Fall River, Massachusetts dedicated to providing our customers with exceptional products, and service.We specialize in fresh and frozen scallops, fish and value-added food solutions. |
|||||
| Ransomware | FUJIFILM Speciality Ink Systems id27004 View details | United Kingdom | Manufacturing / Engineering | — | |
|
FUJIFILM Speciality Ink Systems Ltd is a company that operates in the Chemicals & Related Products industry.The company is headquartered in Saint Peters, Kent, United Kingdom. |
|||||
| Ransomware | Lewis Drug id27003 View details | United States | Communication / Marketing | — | |
|
Founded in 1942, Lewis Drug owns and operates a chain of drug and pharmacy stores.It provides prescription and non-prescription drugs. |
|||||
| Ransomware | HomeSite Services id27002 View details | United States | Services | — | |
|
HomeSite Services Inc., a residential, commercial and retail services company, was founded in 2005 with three goals in mind:to perform superior work, offer quality products, and provide our clients with unbeatable service. |
|||||
| Ransomware | Revival Animal Health id27001 View details | United States | Healthcare / Pharma | — | |
|
Revival Animal Health was founded in 1989 by Dr. Roy Nielsen, Jr., affectionately known as "Doc Roy."Quickly the company expanded from pet vaccines to an extensive line of pet healthcare products. |
|||||
| Ransomware | AJ Networks id27000 View details | Korea, Republic of | Telecommunications | — | |
|
AJ Networks Co. Ltd is a company that operates in the Other Rental Stores (Furniture, A/V, Construction & Industrial Equipment) industry.It employs 500to999 people and has 500Mto1G of revenue. The company is headquartered in Seoul, South Korea. |
|||||
| Ransomware | Integral Analytics id26999 View details | United States | Energy | — | |
|
Integral Analytics specializes in data intelligence solutions for the energy sector, focusing on improving planning and forecasting for utilities, producers, manufacturers, and regulators.Their flagship products include LoadSEER, DSMore, and IDROP, which assist in energy efficiency, demand response, and distributed energy resource management. |
|||||