ChileLocker RaaS profile
ChileLocker, also known as ARCrypter, is a Ransomware-as-a-Service operation that first appeared in August 2022 after the group attacked a Chilean government agency. The malware appends a .crypt extension to encrypted files and uses the NTRU public key cryptosystem for encryption.
The group runs a double-extortion model, encrypting Windows and Linux/VMware ESXi systems while threatening to leak exfiltrated data. A fresh visit to the group’s data leak site on 28 April 2026 confirmed the active RaaS model.
The DLS .onion visit
The data leak site is hosted at z6vidveub2ypo3d3x7omsmcxqwxkkmvn5y3paoufyd2tt4bfbkg33kid.onion. A visit timestamped 28 April 2026 at 07:23:02 UTC confirmed the DLS was live and serving the standard ChileLocker payload set.
The DLS exposes three ransom notes — readme_for_unlock.txt, readme_for_unlock_2.txt, and readme_for_unlock_3.txt — alongside a single YARA rule (chilelocker.yar) and one IoC: the negotiation email chat@proton.me.
RaaS model and affiliate recruitment
ChileLocker operates under a Ransomware-as-a-Service model, allowing affiliates to deploy the malware against their own victims and split the ransom revenue. The group recruits partners through a ProtonMail address, chat@proton.me, which serves as the primary negotiation channel for affiliate communication.
Victim data and ransom notes are published on the group’s data leak site, which is the standard DLS for the operation. The RaaS structure sits within the broader ARCrypter ransomware family, giving ChileLocker the same deployment and encryption mechanics as its parent.
Key points
- ChileLocker (ARCrypter) RaaS profile updated with a fresh 2026-04-28 DLS .onion visit and active RaaS model.
- ChileLocker first appeared in August 2022 after attacking a Chilean government agency and quickly expanded globally.
- ChileLocker uses the NTRU public key cryptosystem for encryption and typically appends the .crypt extension to affected files.
- ChileLocker drops a ransom note—often named readme_for_unlock.txt—and directs victims to a DLS .onion.
- ChileLocker employs a double-extortion model, encrypting Windows and Linux/VMware ESXi systems and threatening data leaks.