Crosslock
CrossLock is a short-lived Go-based ransomware group that appeared in April 2023 and went dark by July 2023, using Curve25519 and ChaCha20 encryption and double-extortion tactics with only one known confirmed victim in the IT sector in Brazil.
Victims
1
First Victim
2023-04-17
(est. attack date)
Discovery Date
2023-04-17
Last Seen
2023-04-17
Inactive Since
3yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
100.0%
victims with domain
Countries
1
hit
Uptime
0.0% avg (30d)
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | Status | |
|---|---|---|---|---|---|---|---|---|
|
Cross Lock - Data leak | No | 2026-08-22T08:37:18 |
crosslock5cwfljbw4v37zuzq4talxxhyavjm2lufmjwgbpfjdsh56yd.onion
|
Target
Top 5 Activity Sectors
- Agriculture and Food Production 1
Top 5 Countries
-
Brazil
1
Heatmap
TTPs Matrix (6)
| Execution | Privilege Escalation | Defense Evasion | Discovery | Lateral Movement | Impact |
|---|---|---|---|---|---|
| Command and Scripting Interpreter | Abuse Elevation Control Mechanism | Process Injection | System Service Discovery | Remote Services | Data Encrypted for Impact |
| Indicator Removal | Process Discovery | Inhibit System Recovery | |||
| File and Directory Discovery |
YARA Rules (1)
Victims (1)
VALID Certificadora Digital Ltda is a company that operates in the Farming industry. It employs 501-…