Ransomware Group intelligence

Lockbit2

Inactive

Track Lockbit2 with 1005 published victims and 5 known leak locations in a single intelligence view.

Victims 1005 Known published victims in this dataset

First discovered 2021-09-09 Earliest victim discovery date

Last discovered 2022-06-28 Latest victim discovery date

Inactive since 1481 days Days since the latest known victim

Top country Italy 29 victims

Known locations 5 Leak or negotiation infrastructure tracked

Lockbit2 is tracked by Breach House as a ransomware group with 1005 published victims.

Italy is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 1	Onion service	Unknown	`zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion`
Leak location 2	Onion service	Unknown	`yq43odyrmzqvyezdindg2tokgogf3pn6bcdtvgczpz5a74tdxjbtk2yd.onion`
Leak location 3	Onion service	Unknown	`oyarbnujct53bizjguvolxou3rmuda2vr72osyexngbdkhqebwrzsnad.onion`
Leak location 4	Onion service	Unknown	`lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion`
Leak location 5	Onion service	Unknown	`lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion`

No sector intelligence available.

Ransom Notes (0)

▼

No ransom notes available for this group.

Tools Used

▼

No tools used available.

YARA Rules (0)

▼

No YARA rules available.

Indicators of Compromise (0)

▼

No IoCs available for this group.

Negotiation Chats (0)

▼

No negotiation chats available.

No external research sources linked yet.

Victims (1005)

Search, filter and paginate the victim timeline for Lockbit2. Showing 101–200 of 1005.

Type	Target	Discovered	Country	Business Category	Intel Link
Ransomware	fed-gmbh.de id3474 View details	2022-05-19	Germany	Other	—
No additional victim description available. ID 3474
Ransomware	http://wsretail... id3472 View details	2022-05-19		Other	—
No additional victim description available. ID 3472
Ransomware	clublinks.com.a... id3467 View details	2022-05-18		Other	—
No additional victim description available. ID 3467
Ransomware	Mercyhurst.edu id3466 View details	2022-05-18	United States	Other	—
Mercyhurst University is a private Catholic liberal arts university in Erie, Pennsylvania, serving more than 2,000 traditional undergraduates on a residential campus. It offers 50+ undergraduate majors, 10+ graduate programs, and other academic services, including study abroad, career development, and student life programs. The university also supports campus engagement through athletics, leadership, and experiential learning. Mercyhurst.edu was listed as a ransomware victim associated with lockbit2. ID 3466
Ransomware	https://clublin... id3465 View details	2022-05-18		Other	—
No additional victim description available. ID 3465
Ransomware	suntecktts.com id3463 View details	2022-05-17		Other	—
No additional victim description available. ID 3463
Ransomware	modetransportat... id3462 View details	2022-05-17		Transportation / Travel / Logistics	—
No additional victim description available. ID 3462
Ransomware	vivalia.be id3460 View details	2022-05-17	Belgium	Other	—
No additional victim description available. ID 3460
Ransomware	2easy.com.br id3458 View details	2022-05-17	Brazil	Other	—
No additional victim description available. ID 3458
Ransomware	khs-wp.de id3457 View details	2022-05-17	Germany	Other	—
No additional victim description available. ID 3457
Ransomware	jaykal id3453 View details	2022-05-17		Other	—
No additional victim description available. ID 3453
Ransomware	sherpamarketing... id3449 View details	2022-05-16		Communication / Marketing	—
No additional victim description available. ID 3449
Ransomware	cassagne.com.ar id3448 View details	2022-05-16	Argentina	Other	—
No additional victim description available. ID 3448
Ransomware	teka.com.mx id3446 View details	2022-05-16	Mexico	Other	—
No additional victim description available. ID 3446
Ransomware	talaadthaii.com id3445 View details	2022-05-16		Other	—
No additional victim description available. ID 3445
Ransomware	saludparatodos.... id3444 View details	2022-05-16		Other	—
No additional victim description available. ID 3444
Ransomware	rexontec.com.tw id3443 View details	2022-05-16	Taiwan, Province of China	Other	—
No additional victim description available. ID 3443
Ransomware	http://2easy.co... id3442 View details	2022-05-16		Other	—
No additional victim description available. ID 3442
Ransomware	grupocabal.cl id3441 View details	2022-05-16	Chile	Other	—
No additional victim description available. ID 3441
Ransomware	STU id3440 View details	2022-05-16		Other	—
No additional victim description available. ID 3440
Ransomware	hinakaorg.com id3439 View details	2022-05-16		Other	—
No additional victim description available. ID 3439
Ransomware	arcelormittal.h... id3438 View details	2022-05-16		Other	—
No additional victim description available. ID 3438
Ransomware	mercyhurst.edu id3437 View details	2022-05-15	United States	Other	—
No additional victim description available. ID 3437
Ransomware	boltburdon.co.u... id3436 View details	2022-05-15		Other	—
No additional victim description available. ID 3436
Ransomware	redgwick. id3435 View details	2022-05-14		Other	—
No additional victim description available. ID 3435
Ransomware	hoffsu id3434 View details	2022-05-14		Other	—
No additional victim description available. ID 3434
Ransomware	optoma.com id3433 View details	2022-05-14		Other	—
No additional victim description available. ID 3433
Ransomware	boltburdonkemp.... id3431 View details	2022-05-13		Other	—
No additional victim description available. ID 3431
Ransomware	www.optoma.com id3430 View details	2022-05-13		Other	—
No additional victim description available. ID 3430
Ransomware	sgservicesud.it id3428 View details	2022-05-13	Italy	Services	—
No additional victim description available. ID 3428
Ransomware	riken-nosan.com id3427 View details	2022-05-13		Other	—
No additional victim description available. ID 3427
Ransomware	mosaiceins.com id3426 View details	2022-05-13		Other	—
No additional victim description available. ID 3426
Ransomware	bradfordmarine.... id3425 View details	2022-05-13		Other	—
No additional victim description available. ID 3425
Ransomware	purapharm.com id3424 View details	2022-05-13		Other	—
No additional victim description available. ID 3424
Ransomware	alliancesand.co... id3423 View details	2022-05-13		Other	—
No additional victim description available. ID 3423
Ransomware	agapemeanslove.... id3422 View details	2022-05-13		Other	—
No additional victim description available. ID 3422
Ransomware	zine-eskola.eus id3421 View details	2022-05-12		Other	—
No additional victim description available. ID 3421
Ransomware	saskarc.com id3415 View details	2022-05-11		Other	—
No additional victim description available. ID 3415
Ransomware	topaces.us id3409 View details	2022-05-10	United States	Other	—
No additional victim description available. ID 3409
Ransomware	sportco.com id3408 View details	2022-05-10		Other	—
No additional victim description available. ID 3408
Ransomware	silverbayseafoo... id3407 View details	2022-05-10		Other	—
No additional victim description available. ID 3407
Ransomware	hansh id3406 View details	2022-05-10		Other	—
No additional victim description available. ID 3406
Ransomware	shimamura.gr.jp id3401 View details	2022-05-09	Japan	Other	—
No additional victim description available. ID 3401
Ransomware	safarni.com id3400 View details	2022-05-09		Other	—
No additional victim description available. ID 3400
Ransomware	realestateconsu... id3395 View details	2022-05-07		Construction / Real Estate	—
No additional victim description available. ID 3395
Ransomware	nipmo.dst.gov.z... id3394 View details	2022-05-06		Other	—
No additional victim description available. ID 3394
Ransomware	mpusd. id3393 View details	2022-05-06		Other	—
No additional victim description available. ID 3393
Ransomware	fnoutlet.com id3392 View details	2022-05-06		Retail / E-commerce	—
No additional victim description available. ID 3392
Ransomware	liceu.barcelon id3387 View details	2022-05-05		Hospitality / Food & Beverage / Tourism	—
No additional victim description available. ID 3387
Ransomware	delcourt.fr id3386 View details	2022-05-05	France	Other	—
No additional victim description available. ID 3386
Ransomware	jewelry. id3371 View details	2022-05-05		Other	—
No additional victim description available. ID 3371
Ransomware	rogz.com id3365 View details	2022-05-04		Other	—
No additional victim description available. ID 3365
Ransomware	nizing.com.tw id3364 View details	2022-05-04	Taiwan, Province of China	Other	—
No additional victim description available. ID 3364
Ransomware	aref.government... id3363 View details	2022-05-04		Public Sector	—
No additional victim description available. ID 3363
Ransomware	fivestar id3356 View details	2022-05-03		Other	—
No additional victim description available. ID 3356
Ransomware	erediriva.it id3352 View details	2022-05-02	Italy	Other	—
No additional victim description available. ID 3352
Ransomware	cwaengineers.co... id3351 View details	2022-05-02		Other	—
No additional victim description available. ID 3351
Ransomware	agenilsen.no id3350 View details	2022-05-02	Norway	Other	—
No additional victim description available. ID 3350
Ransomware	vestas id3345 View details	2022-05-02		Other	—
No additional victim description available. ID 3345
Ransomware	ethiopianai id3342 View details	2022-05-01		Other	—
No additional victim description available. ID 3342
Ransomware	card id3341 View details	2022-05-01		Other	—
No additional victim description available. ID 3341
Ransomware	zdgllc.com id3339 View details	2022-05-01		Services	—
No additional victim description available. ID 3339
Ransomware	smtuc.pt id3338 View details	2022-05-01	Portugal	Other	—
No additional victim description available. ID 3338
Ransomware	orthopaedie-app... id3337 View details	2022-05-01		Other	—
No additional victim description available. ID 3337
Ransomware	sagefruit.com id3335 View details	2022-04-30		Other	—
No additional victim description available. ID 3335
Ransomware	p id3334 View details	2022-04-30		Other	—
No additional victim description available. ID 3334
Ransomware	hispanoamerican... id3333 View details	2022-04-30		Telecommunications	—
No additional victim description available. ID 3333
Ransomware	7generations.or... id3332 View details	2022-04-30		Other	—
No additional victim description available. ID 3332
Ransomware	w id3331 View details	2022-04-30		Other	—
No additional victim description available. ID 3331
Ransomware	brid id3324 View details	2022-04-29		Other	—
No additional victim description available. ID 3324
Ransomware	remar. id3323 View details	2022-04-29		Other	—
No additional victim description available. ID 3323
Ransomware	watermarkbeachr id3320 View details	2022-04-29		Other	—
No additional victim description available. ID 3320
Ransomware	bri id3316 View details	2022-04-29		Other	—
No additional victim description available. ID 3316
Ransomware	hydromaxusa.com id3298 View details	2022-04-28		Other	—
No additional victim description available. ID 3298
Ransomware	ospreyvideo.com id3294 View details	2022-04-28		Communication / Marketing	—
No additional victim description available. ID 3294
Ransomware	warrengibson.co... id3293 View details	2022-04-27		Other	—
No additional victim description available. ID 3293
Ransomware	davislandscapel... id3292 View details	2022-04-27		Other	—
Davis Landscape appears to be a U.S.-based landscape services business operating under the Davis Landscape name, with web evidence showing commercial landscape offerings and hiring activity in the United States. Publicly available references indicate it serves customers such as contractors, developers, multi-family management companies, and HOA/POA organizations. The entity name suggests a company focused on landscaping and related outdoor maintenance work, but the available sources do not clearly identify a single official headquarters page for davislandscapel... itself. It was listed as a ransomware victim associated with lockbit2. ID 3292
Ransomware	multimmobiliare... id3269 View details	2022-04-25		Other	—
No additional victim description available. ID 3269
Ransomware	huesser.ch id3268 View details	2022-04-25	Switzerland	Other	—
No additional victim description available. ID 3268
Ransomware	emucor.es id3267 View details	2022-04-25	Spain	Other	—
No additional victim description available. ID 3267
Ransomware	cronos.com.ar id3266 View details	2022-04-25	Argentina	Other	—
No additional victim description available. ID 3266
Ransomware	schriesheim.de id3265 View details	2022-04-25	Germany	Other	—
No additional victim description available. ID 3265
Ransomware	kdaponte.com id3264 View details	2022-04-24		Other	—
No additional victim description available. ID 3264
Ransomware	gp id3263 View details	2022-04-24		Other	—
No additional victim description available. ID 3263
Ransomware	valoores.com id3261 View details	2022-04-23		Other	—
No additional victim description available. ID 3261
Ransomware	tigergroup.ae id3260 View details	2022-04-23	United Arab Emirates	Services	—
No additional victim description available. ID 3260
Ransomware	greenex id3259 View details	2022-04-23		Other	—
No additional victim description available. ID 3259
Ransomware	ccfsinc.com id3258 View details	2022-04-23		Services	—
No additional victim description available. ID 3258
Ransomware	www.tigergroup.... id3257 View details	2022-04-23		Services	—
No additional victim description available. ID 3257
Ransomware	https://valoore... id3256 View details	2022-04-23		Other	—
No additional victim description available. ID 3256
Ransomware	simplilearn.net id3249 View details	2022-04-22		Other	—
No additional victim description available. ID 3249
Ransomware	fazenda.rj.gov.... id3247 View details	2022-04-22		Other	—
No additional victim description available. ID 3247
Ransomware	lifestylesoluti... id3246 View details	2022-04-22		Other	—
No additional victim description available. ID 3246
Ransomware	produitsneptune... id3245 View details	2022-04-22		Communication / Marketing	—
No additional victim description available. ID 3245
Ransomware	ekz.de id3244 View details	2022-04-22	Germany	Other	—
No additional victim description available. ID 3244
Ransomware	wilshire.com id3243 View details	2022-04-22		Other	—
No additional victim description available. ID 3243
Ransomware	huntongroup.com id3242 View details	2022-04-22	United States	Services	—
No additional victim description available. ID 3242
Ransomware	beckerlaw.com id3241 View details	2022-04-22		Finance / Legal / Insurance	—
No additional victim description available. ID 3241
Ransomware	incegd.com id3240 View details	2022-04-22		Services	—
No additional victim description available. ID 3240
Ransomware	tvothai.com id3236 View details	2022-04-21		Other	—
No additional victim description available. ID 3236

Lockbit2

Overview

Top Countries

Known Leak Locations (5)

Top Activity Sectors