Ransomware.live - Group : Lorenz

Ransomware Group:

Lorenz

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Tesorion describes Lorenz as a ransomware with design and implementation flaws, leading to impossible decryption with tools provided by the attackers. A free decryptor for 2021 versions was made available via the NoMoreRansom initiative. A new version of the malware was discovered in March 2022, for which again was provided a free decryptor, while the ransomware operators are not able to provide tools to decrypt affected files.

Sites

Favicon	Title	Available	Last Visit	FQDN	Screenshot
	Lorenz	🔴	2025-01-11 19:17:27.038793	lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion	N/A
	Lorenz	🔴	2025-01-11 19:17:36.310657	lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion	N/A

Yara Rules

Click here to open yara rules

Ransom Note(s)

Click here to see Ransom Note(s)

Activity over time

Worldmap

78 Victims

Bayer Heritage Federal Credit Union

Ransomware Group:

Discovery Date: 2023-12-11 17:39

Estimated Attack Date: 2023-12-01

Sector:

Victim: | Group:

EOS

Ransomware Group:

Discovery Date: 2023-11-15 14:35

Sector:

Victim: | Group:

Koh Brothers

Ransomware Group:

Discovery Date: 2023-11-09 13:09

Estimated Attack Date: 2023-11-02

Sector:

Group:

Cogdell Memorial Hospital

Ransomware Group:

Discovery Date: 2023-11-09 13:09

Sector:

Victim: | Group:

Truck Bodies & Equipment International

Ransomware Group:

Discovery Date: 2023-11-07 17:41

Estimated Attack Date: 2023-10-27

Sector:

Victim: | Group:

Broad River Retail/Ashley Store

Ransomware Group:

Discovery Date: 2023-10-25 11:57

Estimated Attack Date: 2023-10-15

Sector:

Victim: | Group:

AllCare Pharmacy

Ransomware Group:

Discovery Date: 2023-10-02 17:43

Sector:

Victim: | Group:

BF&S Civil Engineers

Ransomware Group:

Discovery Date: 2023-09-12 14:39

Estimated Attack Date: 2023-08-20

Sector:

Victim: | Group:

Dee Sign

Ransomware Group:

Discovery Date: 2023-09-12 14:39

Sector:

Victim: | Group:

Felling Trailers, Inc.

Ransomware Group:

Discovery Date: 2023-08-30 08:43

Estimated Attack Date: 2023-07-13

Sector:

Victim: | Group:

Tarolli, Sundheim, Covell & Tummino LLP

Ransomware Group:

Discovery Date: 2023-04-05 13:41

Sector:

Victim: | Group:

Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa

Ransomware Group:

Discovery Date: 2023-04-05 13:41

Sector:

Victim: | Group:

NGS Super

Ransomware Group:

Discovery Date: 2023-04-05 13:41

Sector:

Victim: | Group:

Intrasect Technologies

Ransomware Group:

Discovery Date: 2023-04-05 13:41

Sector:

Victim: | Group:

Moore Engineering

Ransomware Group:

Discovery Date: 2023-04-05 13:41

Sector:

Group:

Manning Building Supplies

Ransomware Group:

Discovery Date: 2023-03-14 09:16

Sector:

Victim: | Group:

Tarolli

Ransomware Group:

Discovery Date: 2023-03-14 09:16

Sector:

Group:

Hopsteiner

Ransomware Group:

Discovery Date: 2023-02-20 17:30

Sector:

Victim: | Group:

AmerisourceBergen/Censora - MWI Animal Health

Ransomware Group:

Discovery Date: 2023-02-06 17:38

Sector:

Victim: | Group:

Chestertons Inc.

Ransomware Group:

Discovery Date: 2023-01-10 15:22

Sector:

Victim: | Group:

Thor Specialties, Inc.

Ransomware Group:

Discovery Date: 2023-01-10 13:42

Sector:

Victim: | Group:

Shelco

Ransomware Group:

Discovery Date: 2023-01-10 13:41

Sector:

Group:

Albina Asphalt

Ransomware Group:

Discovery Date: 2022-12-07 12:40

Sector:

Group:

Holler-Classic

Ransomware Group:

Discovery Date: 2022-11-30 17:13

Sector:

Group:

Nissan of Las Cruces

Ransomware Group:

Discovery Date: 2022-11-14 11:51

Sector:

Group:

Salud Family Health

Ransomware Group:

Discovery Date: 2022-11-14 11:51

Sector:

Group:

Main & Main Capital Group

Ransomware Group:

Discovery Date: 2022-11-10 15:36

Sector:

Group:

Miracapo pizza company

Ransomware Group:

Discovery Date: 2022-10-27 11:39

Sector:

Group:

Wes-tec inc.

Ransomware Group:

Discovery Date: 2022-10-18 21:57

Sector:

Group:

Laddawn Inc.

Ransomware Group:

Discovery Date: 2022-09-16 19:12

Sector:

Group:

Engine Power

Ransomware Group:

Discovery Date: 2022-08-23 19:06

Sector:

Group:

Northern Contours Inc.

Ransomware Group:

Discovery Date: 2022-08-22 23:17

Sector:

Group:

Fandeli

Ransomware Group:

Discovery Date: 2022-07-29 00:57

Sector:

Group:

Van Ausdall & Farrar, inc

Ransomware Group:

Discovery Date: 2022-07-13 20:21

Sector:

Group:

Biothane usa

Ransomware Group:

Discovery Date: 2022-07-13 20:21

Sector:

Group:

Gresco

Ransomware Group:

Discovery Date: 2022-07-13 20:21

Sector:

Group:

Uppco

Ransomware Group:

Discovery Date: 2022-07-11 18:37

Sector:

Group:

Wis-Pak, Inc

Ransomware Group:

Discovery Date: 2022-07-05 08:32

Sector:

Group:

Bonneville Collections

Ransomware Group:

Discovery Date: 2022-06-27 17:50

Sector:

Group:

Westwood

Ransomware Group:

Discovery Date: 2022-05-31 16:28

Sector:

Group:

Mebulbs

Ransomware Group:

Discovery Date: 2022-05-26 17:39

Sector:

Group:

Magtek

Ransomware Group:

Discovery Date: 2022-05-19 17:48

Sector:

Group:

Brunk Industries Inc.

Ransomware Group:

Discovery Date: 2022-05-16 16:32

Sector:

Group:

AmCham Shanghai

Ransomware Group:

Discovery Date: 2022-05-16 16:32

Sector:

Group:

Tosoh Corporation

Ransomware Group:

Discovery Date: 2022-05-05 15:30

Sector:

Group:

Tosoh Bioscience

Ransomware Group:

Discovery Date: 2022-05-04 14:33

Sector:

Group:

Morrie's Auto Group

Ransomware Group:

Discovery Date: 2022-04-21 18:28

Sector:

Group:

Musco Sports Lighting

Ransomware Group:

Discovery Date: 2022-04-14 16:22

Sector:

Group:

Simply Placed

Ransomware Group:

Discovery Date: 2022-04-13 17:30

Sector:

Group:

DeeZee

Ransomware Group:

Discovery Date: 2022-04-12 11:18

Sector:

Group:

Advizrs

Ransomware Group:

Discovery Date: 2022-04-11 16:26

Sector:

Group:

Keicorp(ICPM)

Ransomware Group:

Discovery Date: 2022-04-06 15:22

Sector:

Group:

Biz Retek

Ransomware Group:

Discovery Date: 2022-03-29 13:30

Sector:

Group:

Fuji America Corporation

Ransomware Group:

Discovery Date: 2022-03-15 15:24

Sector:

Group:

VadaTech

Ransomware Group:

Discovery Date: 2022-03-15 14:27

Sector:

Group:

Ward Hadaway

Ransomware Group:

Discovery Date: 2022-03-15 13:25

Sector:

Group:

Hensoldt

Ransomware Group:

Discovery Date: 2022-01-11 11:23

Sector:

Victim: | Group:

Turner Enterprises, Inc.

Ransomware Group:

Discovery Date: 2021-12-23 23:52

Sector:

Group:

Kenall/Legrand

Ransomware Group:

Discovery Date: 2021-12-14 17:06

Sector:

Group:

Component Assembly Systems

Ransomware Group:

Discovery Date: 2021-11-15 16:10

Sector:

Group:

SCREEN Holdings

Ransomware Group:

Discovery Date: 2021-09-21 14:13

Sector:

Group:

Sebastian

Ransomware Group:

Discovery Date: 2021-08-10 00:00

Sector:

Group:

Miller-Valentine Group

Ransomware Group:

Discovery Date: 2021-07-29 00:00

Sector:

Group:

MPS Credit Union

Ransomware Group:

Discovery Date: 2021-07-27 00:00

Sector:

Group:

Buchanan Hauling & Rigging

Ransomware Group:

Discovery Date: 2021-06-24 00:00

Sector:

Group:

Langs Building Supplies Pty Ltd

Ransomware Group:

Discovery Date: 2021-06-01 00:00

Sector:

Group:

Langs Building Supplies

Ransomware Group:

Discovery Date: 2021-05-20 00:00

Sector: Critical Manufacturing

Group:

Challenge Manufacturing Company

Ransomware Group:

Discovery Date: 2021-05-11 00:00

Sector:

Group:

Airtech Advanced Materials Group

Ransomware Group:

Discovery Date: 2021-04-29 00:00

Sector:

Group:

DNS Toptech

Ransomware Group:

Discovery Date: 2021-04-13 00:00

Sector:

Group:

Joy Cone

Ransomware Group:

Discovery Date: 2021-04-11 00:00

Sector:

Group:

Wolfe Eye Clinic

Ransomware Group:

Discovery Date: 2021-04-01 00:00

Sector:

Group:

Bases Conversion and Development Authority (BCDA)

Ransomware Group:

Discovery Date: 2021-04-01 00:00

Sector:

Group:

Tygavac ltd.

Ransomware Group:

Discovery Date: 2021-04-01 00:00

Sector:

Group:

The managementtrust

Ransomware Group:

Discovery Date: 2021-02-11 00:00

Sector:

Group:

Multifeeder

Ransomware Group:

Discovery Date: 2021-01-10 00:00

Sector:

Group:

Commport Communications

Ransomware Group:

Discovery Date: 2020-12-20 00:00

Sector:

Group:

Windemuller

Ransomware Group:

Discovery Date: 2020-01-12 00:00

Sector:

Group:

×

Infostealer information available for

Employees(s)	Customer(s)	Third Party Employee(s)

This information is provided by HudsonRock

×

rule ransomware_win_lorenz {
    meta:
        id = "6936cc61-efe5-4d13-b76f-e808ab331457"
        version = "1.1"
        description = "Detect the Lorenz ransomware"
        author = "Sekoia.io"
        creation_date = "2022-02-10"
        classification = "TLP:CLEAR"
        reference = "https://www.cybereason.com/blog/cybereason-vs.-lorenz-ransomware"
        
    strings:
        $s1 = ".onion" ascii
        $s2 = "---===Lorenz. Welcome. Again. ===--" ascii
        $s3 = ".Lorenz.sz40" ascii
        
        $url1 = "egypghtljedbs3x3ui45tfhosakzb376epl7baq2ruzfyewcypswhgqd.onion" ascii
        $url2 = "lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion" ascii
        $url3 = "vsoonropylvbfqnq2urk7uhaxn7afiwgldnj3ntc743awigojm4p7lid.onion" ascii
        $url4 = "kpb3ss3vwvfejd4g3gvpvqo6ad7nnmvcqoik4mxt2376yu2adlg5fwyd.onion" ascii
        $url5 = "vldkrmiqriwlgm2wuxg42nvc6kqsdzsdhsybn27hyn34d66465fxz7id.onion" ascii
        
    condition:
        uint16(0) == 0x5a4d
        and filesize > 900KB
        and filesize < 1200KB
        and (all of ($s*) or 1 of ($url*))
}