Ransomware Group intelligence
Lorenz
InactiveTrack Lorenz with 78 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Lorenz is tracked by Breach House as a ransomware group with 78 published victims.
Australia is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 1h ago | lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion |
| Leak location 2 | Onion service | Down checked 1h ago | lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion |
Top Activity Sectors (10)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Lorenz, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: lorenz executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: lorenz modifies Windows Run registry keys to maintain persistence across reboots.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: lorenz disables antivirus tools by terminating security processes and modifying Windows Defender settings.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: lorenz deletes Volume Shadow Copies via vssadmin /delete command to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: lorenz scans network shares using net use commands to identify victim hosts for lateral movement.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: lorenz uses SMB shares to propagate payloads across networked systems within the victim environment.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: lorenz encrypts victim files using a custom ransomware binary targeting Documents and Images folders.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: lorenz invokes system shutdown commands to disrupt recovery attempts and maximize operational impact.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
HELP_SECURITY_EVENT.html
.sz40 <br> <table align ="center" width="50%" style="border:1px solid darkblue; "> <div class="container"> <tr> <th> <img style="position:relative;z-index:1; width: 100%" src = "data: image/png;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDABsSFBcUERsXFhceHBsgKEIrKCUlKFE6PTBCYFVlZF9VXVtqeJmBanGQc1tdhbWGkJ6jq62rZ4C8ybqmx5moq6T/2wBDARweHigjKE4rK06kbl1upKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKSkpKT/wAARCAFeBBoDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDG8x/77fnR5j/32/Om0VoSO8yT++350eY/99vzptLjHX8qAHB5P77Y+tHmv2dvzphOaKAHeZJ/fb86PMf++3502igB3mP/AH2/OjzJP77fnTaKAHeY/wDfb86PMk/vt+dNooAd5j/32/OjzJP77fnTaKAH+Y/99vzo8x/77fnTKKAHeY/99vzpfMf++350yigB/mP/AH2/OjzH/vt+dMooAf5j/wB9vzo8x/77fnTKKAH+Y/8Afb86PMf++350yigB/mP/AH2/OjzH/vt+dMooAf5j4++350eY/wDfb86bRQId5rj+NvzpfMc9Hb86jooAeZJP77fnR5j/AN9vzpM54P50mMGgB3mP/fb86PMf++3502igB3mP/fb86PMf++3502igB3mP/fb86PMf++3502igB3mP/fb86PMf++3502igB3mP/fb86PMf++3502gUAO8x/wC+350okc8b2/OmUvQUAO8x/wC+350eY/8Afb86aeRmkoAf5j/32/OjzH/vt+dNoFADvMf++350eY/99vzptFADvMf++350eY/99vzptFADvMf++350eY/99vzptFAD/Mf++350eY/99vzptJQA/wAx/wC+350eY/8Afb86bRQA7zH/AL7fnR5j/wB9vzptFADvMf8Avt+dHmP/AH2/Om0UAO8x/wC+350eY/8Afb86bRQA7zH/AL7fnS+Y/wDfb86ZRQA/zH/vt+dHmP8A32/Om0UAO8x/77fnR5j/AN9vzptFADvMf++350eY/wDfb86bRQA7zH/vt+dHmP8A32/Om0UAO8x/77fnS+Y/99vzplLQId5j/wB9vzo8x/77fnTaKYDvMf8Avt+dHmP/AH2/Om0UAO8x/wC+350eY/8Afb86bRQA7zH/AL7fnR5j/wB9vzptFADvMf8Avt+dL5j/AN9vzplFAD/Mf+8350eY/wDeb86bRQA7e/8Afb86N7/3m/Om0UAO8x/7zfnRvf8AvH86bRQA7zH/ALzfnR5j/wB4/nTaKAH73/vH86N7/wB4/nTRQKAHeY/94/nRvf8AvH86bRQA7e/94/nRvf8AvH86bRQA7e/94/nS73/vH86bRQA7e/8AeP50b3/vH86bRQA7e/8AeP50b3/vH86bRQIdvbH3j+dG9/7x/Om0tAC73/vH86N7/wB4/nTaKAHb3/vH86N7/wB4/nSUUALvb+8fzo3v/eP502loAXe/94/nRvf+8fzptFADt7/3j+dG9/7x/Om0UAO3v/eP50b3/vH86bRQA7e/94/nSq7ZzuPHvTKd2oAXe394/nRvb+8fzptFADt7f3j+dG9/7x/Om0UAP3MT94/nQXYn7x/OkHQ0lADt7f3j+dG9v7x/Om0UAO3t/eP512Fr/wAesX+4P5Vxtdla/wDHrD/uL/KpkVE4Oiil6fWmMOn1pKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiloASilpKACiiigAooooAKWikoAWijtSUCCiiigYU7NNpaBC4/Kko6Up/SgBKKKKACiiigAooooAKKKKAAUUGigBQcUEYpKXqPpQAUUlLQAdaKKKACiiigAooooAKKKWgAooooAKKKKACiiigAooooAKKKKAFooooAKKKKACiiigAooopiClpKWgAooooAKKKKACiiigAooooAKKKKAFooooAKKK1otBnliSQTRgMARnNK4GTRWx/wjtx/wA9ov1o/wCEduP+e0X60XQ7Mx6K2P8AhHbj/ntF+tH/AAjtx/z2i/Wi6CzMiitj/hHbj/ntF+tZLoY5GQ8lSQcUXFYbRRS0wEooooAWiiigAooooEFFFFABRRRQAUUUUALRRRQAlLRRQAlFFFABRRRQAUUUUALQegpKcetACUUUUAFLSUUAL2FFB60UAFFFFABXZWv/AB6w/wC4v8q42uytf+PWH/cX+VTIqJwnT60lFFMYUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFLQAUUUUAFFFFABRRRQAlLRRQAUlFFABRRRQAUUUUALQDiiigQHiilHoelIRigAo4oooAKKKKACgUUUAFFFFABSjg0lLQAHrRS9RikoAKKKKACiiigBaOKKSgBaSlooAKKKKACiiigAooooAKKKKACiiigBdpxnBx604xkIrllw3YHkVqx6pBb6WbRU8xypG4Dg59ayKAJNsPnFfMPl9m2/0pAE8tiWIYfdGOtMooAeQmEwxJP3uOlO2w+aR5jbOzbetRUUAPATy2JYh88DHWlIjwmGJz97jpUdFAiULF5rAyNsA4O3rTQqeWSX+fPC46imUtAD3jZNvQ7hkYOaYQQcEYNWdOuVs7xJnTeFzwOtS6rcx3k/2iPC5G3aevHc0DKNFFFMQUUUUAFFFFABRRRQAtFFFABWpFrt1FEsaxwkKABkH/ABrLopWA1v8AhIbv/nnB/wB8n/Gr2kapPfXLRypGAE3fKD6j3rm61/Df/H9J/wBcz/MUmlYaZqaxfS2MKPEqEs2DuBrK/wCEhu/+ecH/AHyf8aueJv8Aj1h/3/6VztCWg2zW/wCEhu/+ecH/AHyf8azJHMkjOerEk1PY2Mt9Lsj4UfeY9BW/Do9jbpmRd5HVnPFF0has5eiuqW20uU7FS3Y+ikZqpe6ChUvaEqw/gJyD+NHMFjBooZSrFWBBHBBHSiqEFFFFABRRRQIKKKKACiiigAooooAWiiigBKWikoAKKKKACiiigAooooAWlbrSUpxnrQAlFFFABRS0UAB6milPU0lABRRRQAo5Irsbb/j2i/3B/KuOHUV2Nr/x6w/7i/yqZFRODopu6jdTGOopNwoyKAFoozRQAUUUUAFFFFABRRS8n6UAJRS8D3oye3FABtPpRj3FJRQAuB60YHrSUUALgetGKKSgQpBHWkpQSKM+ooGJRS49KSgAooooAKKKKACiiigAooooAWiiigQUvUY70lFABRQfWigAooooAKKKKACiiigBcUYpKKAFHBoPBozS9R9KAEooooAKKKKACiiigAooooAWiiigAooooAKKu6fpk98cqNkY6uen4VoG30ax4mkM8g6gHP8AKi4WMKitv+0NHHAsWP8AwEf40f2ho/8Az4N/3yP8aVwMSpIsorSeWGXG3kcAmtj+0NH/AOfFv++R/jS/2lpO0r9ifB5xtH+NFwsYdFbf9oaP/wA+Df8AfI/xo/tDR/8Anwb/AL5H+NFwsYlFbf8AaGj/APPg3/fI/wAaUT6JP8rQNF74x/Ki4WMOiti50QNH51hKJk67c5P4GmaQlinmG+Kb+gVx09adwsZVFSzqhmlMAYxBuDjoKioEFLSUtMAp0TBXyUD9sGm0DqMUAKwKkgjBHY0lPmDCVgzhz3IOc0ykAUUUUwCiiigAooooAWiiigAooooAK1/DX/H9J/1zP8xWRWv4a/4/pP8Armf5ik9hrct+Jv8Aj1h/3/6Vz1dD4m/49Yf9/wDpWFaqHuoVPRnUH86S2B7nV6bbLZ2SJjDY3Ofeud1O/e8nbDERKcKvb610mouUsJ2HUIa46iPcbAEg5Bwa6PQb9rhGgmbc6DKk9SK5yr2iuU1OLHfI/Sm9hIueI7UJIlyoxv8Alb61i11OvLu01j6MDXLUo7A9xaKKKoQUUUUCCiiigAooooAKKKKAFooooAKKKSgAooooAKKKKACiiloAKD1opTzigBKKKM0AFLSUtAA3WilPakoAKKKKACuytv8Aj2i/3B/KuOrsbX/j1h/3F/lUyKicBRSUtBQUUUUAJS0lFAC5NGTSUtAhdxpdx6AU0CjPYUwHbgPc0bs0yigB+RS5FMooAfRTKM0APpaZk0BjQA+kpN1G6gBaKTcKXIoAKXPrSZFFACkenSkpQcUdelAhKKKKBhRRRQAUUUUALRRRQIKKKKAAelFFKeRmgBKKKOtABRRRQAUUUUAFFFFABSjrj1pKWgAooPXPrRQAUUUUAFFFFABRS0lAC0UUUAFXdJsTfXQU8Rry59vSqVbtufsPh55l4kmOAf0/xoYIi1bU/wDl0sz5cKfKSvf/AOtWPRRQAUUUUAFLSUtABRRRQAU4IxQuFJVep9KcFCCORtrq3O0Hn8aazZLbcqpOduaALFvePZTK9s7YwNyt0NaeowRajZfb7ZcSL/rFFYVa3h2fZdtbnlZVPHuP8mk+4Iyw7KpUMQG6j1p4QTOqQqQ2Ocnqadew/Z7uWLsrED6VBTAWinb/AN3s2r1zu70roA7LG3mAc5AoEMoooHWmA6TZvPl529s02nzFjKdyBD/dAximUgCiiimAUUUUAFFFFAC0UUUAFFFFABWv4a/4/pP+uZ/mKyK1/DX/AB/Sf9cz/MUnsNblvxN/x6w/7/8ASsK2YJcxOeiuD+tbvib/AI9Yf9/+lc9SWwPc7LUEMljOg6lDiuNrrdKulu7JSTl1G1x71harpslrMzopaFjkEdvY0o9hsz6v6IhfU4sD7uSfyqiqM7bVUk+gFdLomntaxtLMMSP2/uiqb0Eh2vsF01h/eYCuXrX8Q3YlmW3Q5EfLfWsmhbA9wooopiCiiigQUUUUAFFFFABRRRQAtFFFABRRSUAFFFFABRRRQAUvagUdaACl/h9qSgdxQAUUUUAFLRRQAv8ADSUo60mKACiiloAK7G1/49Yf9xf5Vx1dja/8esP+4v8AKpkVE8/ooooKFoopKAFpKWigAoAzRR2wKBATn6UlFFAwooooAWiiigAooooAKKKKAF7UlKKSmIWiiigAooooAKXJpKKAHZz9aTNFKeeaADNGaSigBc0ZpKKAFpaaBk4FFADqKbS0ALQPT1pM0A0CFPpR2oPr60UAFFFFABRRRQAUUUUALRSUtAC9vpSUDuKKAA0UdqKACilpKACilpKAFooooAK0LrUI5tLt7VUYNH94npWfRQAUUUUAFFKASQAMn0rXstFwnn37eVEOdpOCfr6UAULKxnvZNsS/L3Y9BXRWVhY2ySRfLLIq/vCRnA/pWbe6yFj+z6evlRDjcBgn6U/w+SYbwk5JXr+BqWNEd9o4KfaLBvNhPO0ckfT1rNLCF3WMhgRtyy1LY6hPYvmJsqeqHoa1TFY60paI+Rc45Hr/AI09gMCip7uzns5NkyY9D2NQUxBVzRzjVIP97+lU6uaR/wAhO3/3qGA/W/8AkKTfh/KqFX9b/wCQpN+H8qoULYGFOR2TO1iMjBxTaWmIf8jKiquHzyxPBpHQo5UkZBxkdKbTkkZFYL0YYPFIBZgRIcuHP94HOaZT9qMEVM7zw2elNZSjFT1HpQAlFFFMAooooAKKKKAFooooAKKKKACruk3qWNw0jqzArtwv1FUqKANTVtUiv4URI3Uq2fmxWXRS0gJrO7ls5fMibHqD0Nb8GvWsi4mDRHvxkVzVFDVxp2Op/tXTUyyyLn2Q5/lVG+14upS1Urn+Nuv4CsSilyoLikknJOSaSilqhBRRRQAUUUUCCiiigAooooAKKKKAFopKKAClpKKACilooASilooAKKKWgBKUcGiigAIwaKU8jNJQAUUUUAFL1GaSlBx9KAEopSMUlACmuxtf+PWH/cX+Vcd2rsbX/j1h/wBxf5VMionn9FFFBQUtFJQAUtJSjrQAdBR2oPWigQlFFFAwooooAWiiigAooooAKKXafSjaaYhBRS4I60lAC0HrRRQAUUUUAFFFFAC0DiiigAIxRS9R9KSgAooooAKKKKACiiigBaKKKAF7fSkpR1pKACiiigAooooAWiiigQUUUUAKDzR0NJSnrQAUUdqSgBwpKKKAFpKKKAFopKWgAooqW2tZrp9kEZc9/QUARVcsdNuL1v3a7U7u3StGPTLPTkEuoSh27Rjp/wDXqte63LMvlWy+RF0+XqR/SlfsMubtP0UfL+/uvX0/wrIvb+e9fdM/y9lHQVWPPJop2EFbfh7/AFF5/uf0NYlbfh7/AFF5/uf0NJ7DRi0qsVYMpII6EUlFMRs2msrLH9n1FBLGeN+OfxpLvRQ6efp7iWM87c5P4Vj1PaXk9m+6FyPVex/ClbsFyFlZGKspUjqDVvSP+Qnb/wC9Wkt3YaqoS7QQzdA4/wAf8abb6RPaalBIpEkIb7w7fWi47FLW/wDkKTfh/KqFX9b/AOQpN+H8qoU1sJhS0lLTEFFFFABTlkZFZRjDDB4ptFAEmEYIqZDHhiTxTWQqzL1x1I5ptOSRkDBSQGGD70gG0U8lCiLt2kdWz1qRLaSaZo7cGXHOQO1AEFFOZWRirAhhwQe1NpgLRRRQAUUUUAFFFFABRRRQAtFFFABRRRmgAooooAWikooAWikooAWikpaACiiigQUUUUAFFFFABRRRQAtFFFABRRRQAUtJS0AFFFFACikopeozQAlFFFABRRRQAo54/Kikp3Xg9aAEFdja/wDHrD/uL/KuO9a7G1/49Yf9xf5VMionn9FFFBQUUUUAFL2ooPWgQUUUUDCkpaSgAooooAWiilzjgfnQIOB15oye3FJRTAKKKBSGKCQKM56ikpaYgI/KigHFBHcUAFFFFABRRRQAtFFFAAODQetFL2FABtO3d2pKKKACiiigAooooAWiiigApTSUp7UAJRRRQAUUUUALRRRQIKKKKAClPQUlL2oADRSUpoAKKKKACiirNrp91dn9zESv948CgCtUtvbTXL7IY2c+w4FbC6VZWKiTULgM3XYP85NMuNdCJ5VhCsSD+Ijn8qV+wx0WjW9ogl1KdR/sA9f8abc64I08nT4hEg/iI5/KsiWaSdy8rs7HuTmmUWAfJI8rl5GLMepJptFFMQUUUUAFbfh7/UXn+5/Q1iVt+Hv9Ref7n9DSew0YlLSUUxC0UUUAFXrHVbmzIAbfH/cb+npVGigDfMmm6ufnzBcHjJPX/GqF5o91a5YL5sf95P8ACs+r1nq11aYAbzE/utStbYClRW6JtL1MYlX7PMe44z+PSqt1odzEN8JE6f7PX8qdwsZlFKysjFWBBHUEUlMQUUUUAFFFFABV7Sb77DcEkDY4wao0+FgrgmPzBg/LSAdcztc3DzOAC5zgVHSZooAWikopgLRSUUALRmkooAWiiigAooooAKKKKACiiigBaKKKACiiigApaSloAKKKKBBRRRQAUUUUAFFFFAC0UUUAFFFFAC0dqSloAKKKKACgcGiigBSMUlKPQ0nSgAooooAKKKUUALnjBrsLX/j1i/3B/KuONdja/wDHrD/uL/KpkVE8/opaSgoKKKms5BDdxSMAVVwSD0xQBEKSu7urOGe0ljWJAXQgEKBz2rhTwcGhO4CUtJW34XtllupZXUMqLgZGeTQBi0V3dzZwzW0kYiQFlIBCjrXCEEEjuKE7gJRS1teF7ZZbuSR1DKiYGRkZNAGN0HuaSum8TmKGzjjSNFaR+y4OB/kVzNCAKKKKACiiigQVfttIvLuBZ4Y1KNnBLAdDiqPaux8Pf8geD/gX/oRobsM5GeF7eZ4pBh0OCM5pgNXNY/5Ctz/vmqdAgIwaKXqKSmAUUUUALRRRQAUo6GkpV60AJRRUgiJHJxQBHRTmQrTaACiiigBaKKKACl/hpKUdDQAlFFLQAlFLSUALRRRQIKKKKACl7UlKOhoABSUUUALV7TNMfUN7CRUjThiao1uaHzpl+P8AZP8A6CaTGO26PpvUm5lH4/8A1qrXWvXMvywAQJ7dfzrKoosFxWZnYszFiepJzSUUUxBRRRQAtFFFABRRRQAVt+Hv9Ref7n9DWJW34e/1F5/uf0NJ7DRiUUUUxBS0lLQAUUUUAFFFFABVq11C5tCPKlO3+6eRVWigDcXVrO8XZf24B/vqM/8A1xSSaLDOhksLlXA52sc1i1s+Gh89yf8AYFJ6D3MYjBIPailb7x+tJVEhRRRQAVLAJNzGNgCFJPPaoqeAnlklvnzwuOtIBI42kbaoycZoEeYy+5Rg4255NLJI0j7m69OBim0AOaJgE6Nv6AHJprKVJDAgjsaASCCOCKtWKJeXixzs2ZON2ehoAqUVp6zp8Vi8flOSHB4PUVm0AJRS0UwCiiigAooooAKKKKACiiigBaKKKACiiigApaSloAKKKKBBRRRQAUUUUAFFFFAC0UUUAFFFFABS0lFAC0UUUAFFFFABSjng0lFABRS9ev50YoASl9qPpRQAD1rsbX/j1h/3F/lXHV2Nr/x6w/7i/wAqmRUTz+iiigoKKKKAO60uf7Rp0EmcnYAfqOK5HVofs+pTx9t2R9Dz/Wt3wrPvs5ISeUfI+h/+vmqfiuHbdxTDo64/Ef8A66S3Awq63wxB5em+YRzKxP4DiuTrtwBp+kc8eVF+uP8AGhgJpl4Lt7oZz5cpA+nb+Vcpq8PkanOnbduH481oeFpyt9JET/rFz+I/yad4rh23UU2PvrtP1H/66OoGDXW+F4PL05pCOZHJ/Acf41ydd5Ywi3soYv7qDP170MEc54on36gsQPEaDP1PP+FY2asahP8AaL6aXruc457dq1fD2lLcf6VcLmMHCKe59aeyAz7TSr28AaOIhD/ExwKt/wDCNX39+D/vo/4VsaprMOnnylXzJcfdBwF+tZP/AAk11vz5UW305pagVLjR7u1BaaP5B/EpyKrGIdq63S9Vi1FCpXZIBymc5+lZWuaetrIJohiNzyP7ppp9xMwiCDzXY+Hv+QPB/wAC/wDQjXISEFzXX+Hv+QPB/wAC/wDQjSY0c1rH/IVuf9+qdXNY/wCQrc/79VFUuwVQSxOAKYhUVnO1QWJ6Ad60YNAv5lyUWMf7bYrf0nTI7CEMwBmYfMx7ewqnfeI44pDHaxiTHVyePwpX7DKJ8N3wH34T7bj/AIVRutOu7TmaFgv94cj860F8S3QPzRRsPTkVYuddgvNOniZGilZcAdQT9aNQOeo68Cium8PaWkcS3cy5kblAf4R6027CMq30O+uF3eWI1Pdzj9Kn/wCEcvRzuhOOwY/4Vp6priWUhhiQSSjrk8LWfF4luA/7yGNlz0HBpajMy5srizkAniKjPB6g/jS118MttqdnkAPG3DKexrldUtH0+7MQJMZ5Qn0ppiaK8v3cVL/Zl6U3/Zn24zn2qqSWPNd3Cu+zRc9YwP0obBI4q1tJ7t9sEZcjr6D8a0R4bvSPvwj23H/CtSe9s9EgS3jTe4Gdo6n3Jqmnic7/AJ7YbPZuaV2MyrzTrmy5mjwp6MORVVQWYKoJJ4AFdzG8GoWm4APFIOQaz7HToNJWW5uGBIJ2sew/xouFjJg0C+lTcVSP2duf0pZtBvoYywVJPZDz+tXZvE3zYht8r6s3X8Kv6Xq8WoEps8uUDO3Ocj2ouw0OQIIJBGCOoNJW/wCJrJVK3aLgsdr4/Q1g1SEJVq0sLq7/ANTEWX+8eB+dWtE00X0xeUHyY+v+0fSt6/1G30yJV25bHyxrxx/Sk2FjFHhy9I+/CP8AgR/wqvc6Ne2ylmjDqOpQ5q03iS5LZWKMD05NaOl63HeyCGVBHKenPDUtQ0OVorf8Q6air9shXHP7wD+dYFUncApR0P0pKUd6BCUUUUALW54e5tb1PVf6GsOtvwwcvcp6oKT2GjEooIwcUUxBRRRQAUUUUALRRRQAUUUUAFbfh7/UXn+5/Q1iVt+Hv9Ref7n9DSew0YlFFFMQUtJS0AFFFFABRRRQAUUUUxC1teHOEu2/2R/WsWtrQ/l0++f0U/yNJ7DRi0UUUxBRRRQA+NGckrj5RuOaSRzI5dsZPoKUBPLJJO/PA7YplIApaSlBwcimA9igCjYQw+9k9aHzu8xEKIT8tDkOpkaTMhPTH60SMp2qm7aB0Y9+9IBS/mqzSyszgfLnnNR0+E7ZAdgf/ZPemnqeMUwEooooAKKKKAFooooAKKKWgBKKX8KPwoAKKPwooEGKMUUfhQAUUfhS0AJRRRQAUUUUAFFLRQAlFLiigAooo/CgAoo/Cj8KACilooAKKKKACiiigAooooAKXPrzRRQAEflR0oB9qXg+1ADa7K1/49Yf9xf5Vxx+ldja/wDHrD/uL/KpkVE8/ooooKCiiigDZ8LzeXqBjPSRSPxHP+NavieDzNN8wDmJgfw6VzNjN9nu4pf7jAn6V217CLizmi670IFJ7gcZpUH2jUYI8ZBbJ+g5ro/E03laZsB5kYL/AF/pWb4WgLXsspH+rXH4mneK5t1zDCP4F3H8f/1UdQMzS5vs+owSdg+D9Dx/Wuj8TQebpm8DmNg34dK5Ku3XF/pHP/LWL9cf40MDkdMh+0ajBH2Lgn6Dk12WozfZ7CaQHBCkD6ngVz/haAtfSyMP9UuPxP8A+o1e8Uz7LFIgeZHyfoP8ih7gcsoLMFHUnFd7BGtpZIiqcRp0HU4FcND/AMfEZ9WH8672WQRRPIQSEUsQPahgjhpoLyaV5XgmLMck7DTfslz/AM+8v/fBro/+Ens/+eM/5D/Gj/hJ7P8A54z/AJD/ABouwMXTo7u3vYZBDKoDjPyHp3rp9bj8zSp/VV3A/SqX/CT2f/PGf8h/jUV54gtbizmhWKYM6FQSBjn8aNQObrs/D3/IHg/4F/6Ea43Ndj4e/wCQPB/wL/0I0MEc1rH/ACFLn/fNT+HoBNqiE8iMF/8ACoNY/wCQrc/75q74V/5CEv8A1yP8xT6Aa/iG5a301ghw0h2j6d64+um8V/8AHtB6bz/KuZoQMKBRRTES20fnXEcX99wv5mu4uJFtbR5ABiNMgfQVxmm/8hK1/wCuq/zrrdY/5Bdz/uGpY0cU7M7FmOWJySe9IOoopV61QjY8MXBS9aAn5ZFJx7j/ACav+KIg1lHL3R8fgayPD+f7Wix6H+Vb3iEj+ypM9yMfnUvcfQ5Gu7gIW0jY9BGD+lcHXdJ/yDx/1y/pQwRxV1M1xcySucl2JqPFGaSqEdP4Wcm0mQnIV8j8RVfxTOfMhtw3AG8j9B/WpfCn+puP94fyqn4o/wCQkn/XIfzNT1H0MirmkOY9SgYHHzgfnVOrWm [...]
Truncated for display. View on RansomLook
lorenz.txt
[+] What happened? [+] Your files are downloaded, encrypted, and currently unavailable. You can check it. By the way, everything is possible to recover(restore), but you need to follow our instructions.Otherwise, you can't return your data(NEVER). [+] What guarantees ? [+] It's just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. It's not in our interests. To check the ability of returning files, You should go to our website.There you can decrypt some files for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. After deadline well publish all the contents of your company to site and will send all information to your clients and mass media. You we will lose your time, data and reputation. [+] How to get access on websiteand contact us ? [+] Using a TOR browser! a) Downloadand install TOR browser from this site: https://torproject.org/ b) Open a website specially designed for you:http://lorenzedzyzyjhzxvlcv347n5piltxamo755pzqpozh5l47kj7mxueid.onion/ Key ID:[snip] Check our website with leaks : http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (78)
Search, filter and paginate the victim timeline for Lorenz. Showing 1–78 of 78.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Bayer Heritage Federal Credit Union id9962 View details | Finance / Legal / Insurance | — | ||
|
No additional victim description available. |
|||||
| Ransomware | EOS id9576 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Koh Brothers id9464 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Cogdell Memorial Hospital id9463 View details | United States | Healthcare / Pharma | — | |
|
No additional victim description available. |
|||||
| Ransomware | Truck Bodies & Equipment International id9435 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Broad River Retail/Ashley Store id9220 View details | Retail / E-commerce | — | ||
|
No additional victim description available. |
|||||
| Ransomware | AllCare Pharmacy id8934 View details | Healthcare / Pharma | — | ||
|
No additional victim description available. |
|||||
| Ransomware | BF&S Civil Engineers id8593 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Dee Sign id8592 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Felling Trailers, Inc. id8359 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Tarolli, Sundheim, Covell & Tummino LLP id6029 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa id6028 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | NGS Super id6027 View details | Australia | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | Intrasect Technologies id6026 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Moore Engineering id6025 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Manning Building Supplies id5703 View details | Construction / Real Estate | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Tarolli id5702 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Hopsteiner id5497 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | AmerisourceBergen/Censora - MWI Animal Health id5377 View details | Healthcare / Pharma | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Chestertons Inc. id5219 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Thor Specialties, Inc. id5217 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Shelco id5216 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Albina Asphalt id4756 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Holler-Classic id4691 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Nissan of Las Cruces id4576 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Salud Family Health id4575 View details | Healthcare / Pharma | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Main & Main Capital Group id4560 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Miracapo pizza company id4397 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Wes-tec inc. id4360 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Laddawn Inc. id4194 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Engine Power id3995 View details | Energy | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Northern Contours Inc. id3989 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Fandeli id3883 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Van Ausdall & Farrar, inc id3778 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Biothane usa id3777 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Gresco id3776 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Uppco id3765 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Wis-Pak, Inc id3735 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Bonneville Collections id3690 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Westwood id3567 View details | United States | Other | — | |
|
No additional victim description available. |
|||||
| Ransomware | Mebulbs id3542 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Magtek id3478 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Brunk Industries Inc. id3452 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | AmCham Shanghai id3451 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Tosoh Corporation id3385 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Tosoh Bioscience id3366 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Morrie's Auto Group id3238 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Musco Sports Lighting id3174 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Simply Placed id3158 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | DeeZee id3143 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Advizrs id3137 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Keicorp(ICPM) id3102 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Biz Retek id3000 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Fuji America Corporation id2835 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | VadaTech id2834 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Ward Hadaway id2833 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Hensoldt id2427 View details | Other | |||
|
No additional victim description available. |
|||||
| Ransomware | Turner Enterprises, Inc. id2273 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Kenall/Legrand id2176 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Component Assembly Systems id1924 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | SCREEN Holdings id1421 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Sebastian id672 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Miller-Valentine Group id667 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | MPS Credit Union id666 View details | Finance / Legal / Insurance | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Buchanan Hauling & Rigging id658 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Langs Building Supplies Pty Ltd id645 View details | Construction / Real Estate | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Langs Building Supplies id634 View details | Australia | Construction / Real Estate | — | |
|
No additional victim description available. |
|||||
| Ransomware | Challenge Manufacturing Company id623 View details | Manufacturing / Engineering | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Airtech Advanced Materials Group id609 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | DNS Toptech id605 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Joy Cone id604 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Wolfe Eye Clinic id599 View details | Healthcare / Pharma | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Bases Conversion and Development Authority (BCDA) id600 View details | IT | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Tygavac ltd. id601 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | The managementtrust id581 View details | Services | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Multifeeder id560 View details | Other | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Commport Communications id553 View details | Communication / Marketing | — | ||
|
No additional victim description available. |
|||||
| Ransomware | Windemuller id316 View details | Energy | — | ||
|
No additional victim description available. |
|||||