Actor Profile

🏹 AiLock — Ransomware

AiLock is a ransomware operation that emerged in early 2025, marketing itself as AI-assisted ransomware using a hybrid ChaCha20/NTRUEncrypt encryption scheme and double-extortion tactics, actively recruiting affiliates and threatening regulatory reporting if ransoms are unpaid.

🔄 Pivot:🌎 US 🏹 AiLock

Classification

Ransomware

Leak-site victims

Ransomware.live

Associated IoCs

local intel

MITRE techniques

—

ATT&CK

Tracked

Yes

Ransomware.live

PIVOT🔍 Advanced Search 🕵 OSINT Pivot 🔗 Link Analysis 🕑 Timeline 📤 Export STIX/MISP

🔥 Leak-Site Victims (47)

Victim	Country	Published	Domain
Nihon Kotsu Co., Ltd.	JP	2026-07-15T09:50:07.867185+00:00	`nihon-kotsu.co.jp`
Ferrovial	ES	2026-07-15T09:20:09.317932+00:00	`ferrovial.com`
WBF Construction		2026-07-14T12:20:12.567010+00:00	—
Solid Advance Inc.	JP	2026-07-15T09:20:31.022167+00:00	`solid-adv.co.jp`
Pinturas Prisa	MX	2026-07-09T08:20:07.194384+00:00	—
Studio Sardano	IT	2026-07-07T08:50:08.867748+00:00	`studiosardano-riccione.com`
Richmont Graduate University	US	2026-07-07T08:20:11.784021+00:00	`richmont.edu`
Hokua	CL	2026-06-26T08:50:06.359541+00:00	`hokua.net`
Röben Tonbaustoffe GmbH	DE	2026-06-15T14:50:08.378188+00:00	`roeben.com`
Groupe Sécurité CLB	FR	2026-06-04T19:50:05.594589+00:00	`securiteclb.com`
Schneebeli	CH	2026-06-01T07:50:05.927887+00:00	`schneebeli.ch`
Restorative Therapies, Inc.	US	2026-05-29T09:20:06.587207+00:00	`restorative-therapies.com`
Artso International, Inc.	TW	2026-05-24T09:20:05.564402+00:00	`artso.com`
Design Engineering & Consulting	US	2026-05-18T10:50:05.236911+00:00	`decusa.com`
Jazz Hipster	US	2026-05-18T10:20:05.703236+00:00	`jazzhipster.com`
Accretech America Inc.	US	2026-05-11T07:20:06.080984+00:00	`accretechsbs.com`
Site Design Group	US	2026-05-02T06:50:05.550835+00:00	`site-design.com`
Raich Sp. z o.o.	PL	2026-04-27T15:34:22.430877+00:00	`raich.net`
Mother's Market & Kitchen	US	2026-04-23T20:18:19.842640+00:00	`mothersmarket.com`
PremCom	GB	2026-04-22T10:41:07.693836+00:00	`premcom.co.uk`
Alvi Associates	US	2026-04-10T09:28:35.245486+00:00	`alviassociates.com`
Berning & Söhne GmbH	DE	2026-04-03T10:51:22.535305+00:00	`berning-net.de`
Piet Vijverberg	NL	2026-04-03T10:50:57.190754+00:00	`pietvijverberg.nl`
Solutions Extreme Technology	CA	2026-03-17T13:44:53.176392+00:00	`solutionsextreme.com`
England Hockey	GB	2026-03-12T08:41:35.002157+00:00	`englandhockey.co.uk`
Johnson Vollmerhausen & Gates	US	2026-03-07T08:27:25.983164+00:00	`jvgasheville.com`
Netwerk NV	BE	2026-03-07T08:27:00.707121+00:00	`netwerknv.nl`
Eeyou Communications Network	CA	2026-03-07T08:26:37.066199+00:00	`eeyou.ca`
Demanor	NO	2026-03-03T09:46:50.729208+00:00	`demanor.no`
Aaronson Rappaport Feinstein & Deutsch	US	2026-03-03T09:46:27.072512+00:00	`arfdlaw.com`
ELO Digital Office	DE	2026-03-03T09:43:39.435579+00:00	`elo.com`
Dallas Regional Chamber	US	2026-03-03T09:46:02.557318+00:00	`dallaschamber.org`
ShopBot Tools	US	2026-03-03T09:45:38.948224+00:00	`shopbottools.com`
Navicore Solutions	US	2026-03-03T09:45:15.245190+00:00	`navicoresolutions.org`
S&R Compression, LLC	US	2026-03-03T09:44:27.341232+00:00	`sandrcompression.com`
Emanuelson-Podas	US	2026-03-03T09:44:03.148696+00:00	`epinc.com`
Professional Retail Outlet Services	US	2026-03-03T09:44:50.705172+00:00	`proservicecall.com`
Promotion Management Center	JP	2026-03-03T09:43:16.121930+00:00	`pmci.com`
Sterling Industries	US	2026-03-03T09:42:52.599213+00:00	`sterlingindustries.com`
Raw Seafoods	US	2026-03-03T09:42:27.329693+00:00	`rawseafoods.com`
FUJIFILM Speciality Ink Systems	GB	2026-03-03T09:42:01.779170+00:00	`fujifilmink.com`
Lewis Drug	US	2026-03-03T09:41:57.950444+00:00	`lewisdrug.com`
HomeSite Services	US	2026-03-03T09:41:34.499130+00:00	`homesiteservices.net`
AJ Networks	KR	2026-03-03T09:40:46.264529+00:00	`ajnetworks.co.kr`
Integral Analytics	US	2026-03-03T09:40:21.405747+00:00	`integralanalytics.com`
Transsion	CN	2026-03-06T05:51:09.709095+00:00	`transsion.com`
Revival Animal Health	US	2026-03-03T09:41:10.676682+00:00	`revivalanimal.com`

Source: Ransomware.live leak-site monitoring (cached, offline-safe).

MITRE ATT&CK Groups ↗ Ransomware.live ↗ APT Theater →

🏹 Campaigns & malware

Campaigns →Malware families →Nation-State theater →Sanctions →Wanted & Rewards →

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

🧭 Intelligence disciplines

CYBINT →OSINT →HUMINT →GEOINT →

Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook

🏹 AiLock — Ransomware

Classification

Leak-site victims

Associated IoCs

MITRE techniques

Tracked

🔥 Leak-Site Victims (47)

🏹 Campaigns & malware

🗃 Data Management

🧩 Advanced Capabilities

🧭 Intelligence disciplines

🤖 AI Copilot

⚡ AI Skills

🔍 Lookup & Enrich

📚 Docs & Reports

💡 Recommendations

⚙ Automation

📜 Playbook

🔗 Related Tools