[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiFdWfRVU-OKXhYn6Qm8jnOMLmWrBUgwqwPEj74LYspI":3,"$f270u74laYzuG-p7XL-9DDnuiZt98EZ0uRHhBNAnpU-A":51},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":7,"tags":8,"body_md":14,"hero_image_url":15,"structured":16,"story_type":48,"created_at":49,"updated_at":50,"published_at":29},"chilelocker-raas-profile-updated-with-fresh-dls-onion-and-active-raas-model","ChileLocker RaaS profile updated with fresh DLS .onion and active RaaS model","ChileLocker (ARCrypter) RaaS profile updated with a fresh 2026-04-28 DLS .onion visit and active RaaS model.",[9,10,11,12,13],"ChileLocker","ARCrypter","RaaS","DLS","NTRU","# ChileLocker RaaS profile updated with fresh DLS .onion and active RaaS model\n\n*ChileLocker (ARCrypter) RaaS profile updated with a fresh 2026-04-28 DLS .onion visit and active RaaS model.*\n\n**Tags:** `ChileLocker` `ARCrypter` `RaaS` `DLS` `NTRU`\n\n> ChileLocker (ARCrypter) RaaS profile updated with a fresh 2026-04-28 DLS .onion visit and active RaaS model.\n\n---\n\n## ChileLocker RaaS profile\n\nChileLocker, also known as ARCrypter, is a Ransomware-as-a-Service operation that first appeared in August 2022 after the group attacked a Chilean government agency. The malware appends a `.crypt` extension to encrypted files and uses the NTRU public key cryptosystem for encryption.\n\nThe group runs a double-extortion model, encrypting Windows and Linux\u002FVMware ESXi systems while threatening to leak exfiltrated data. A fresh visit to the group’s data leak site on 28 April 2026 confirmed the active RaaS model.\n\n## The DLS .onion visit\n\nThe data leak site is hosted at `z6vidveub2ypo3d3x7omsmcxqwxkkmvn5y3paoufyd2tt4bfbkg33kid.onion`. A visit timestamped 28 April 2026 at 07:23:02 UTC confirmed the DLS was live and serving the standard ChileLocker payload set.\n\nThe DLS exposes three ransom notes — `readme_for_unlock.txt`, `readme_for_unlock_2.txt`, and `readme_for_unlock_3.txt` — alongside a single YARA rule (`chilelocker.yar`) and one IoC: the negotiation email `chat@proton.me`.\n\n## RaaS model and affiliate recruitment\n\nChileLocker operates under a Ransomware-as-a-Service model, allowing affiliates to deploy the malware against their own victims and split the ransom revenue. The group recruits partners through a ProtonMail address, `chat@proton.me`, which serves as the primary negotiation channel for affiliate communication.\n\nVictim data and ransom notes are published on the group’s data leak site, which is the standard DLS for the operation. The RaaS structure sits within the broader ARCrypter ransomware family, giving ChileLocker the same deployment and encryption mechanics as its parent.\n\n## Key points\n\n- ChileLocker (ARCrypter) RaaS profile updated with a fresh 2026-04-28 DLS .onion visit and active RaaS model.\n- ChileLocker first appeared in August 2022 after attacking a Chilean government agency and quickly expanded globally.\n- ChileLocker uses the NTRU public key cryptosystem for encryption and typically appends the .crypt extension to affected files.\n- ChileLocker drops a ransom note—often named readme_for_unlock.txt—and directs victims to a DLS .onion.\n- ChileLocker employs a double-extortion model, encrypting Windows and Linux\u002FVMware ESXi systems and threatening data leaks.\n\n## Further reading & sources\n\n- [Ransomware.live: chilelocker](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fchilelocker)\n- [Chilelocker · RansomLook](https:\u002F\u002Fransomlook.io\u002Fgroup\u002Fchilelocker)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fchilelocker-raas-profile-updated-with-fresh-dls-onion-and-active-raas-model.png?v=51f51c678d",{"iocs":17,"actors":24,"malware":31,"targets":33,"industries":39,"technologies":44},[18,21],{"type":19,"value":20},"domain","z6vidveub2ypo3d3x7omsmcxqwxkkmvn5y3paoufyd2tt4bfbkg33kid.onion",{"type":22,"value":23},"email","chat@proton.me",[25],{"url":26,"name":9,"slug":27,"type":28,"origin":29,"motivation":30},"\u002Fthreat-groups\u002Fchilelocker","chilelocker","ransomware",null,"financial",[32],{"name":9},[34],{"name":35,"sector":36,"status":37,"geography":38},"Chilean government agency","Public Sector","confirmed","Chile",[40],{"url":41,"name":42,"slug":43},"\u002Findustries\u002Ffederal-national-government","Federal \u002F National Government","federal-national-government",[45],{"vendor":46,"product":47},"Microsoft","Windows","ransomware_incident","2026-08-27T07:08:37.936162+00:00","2026-10-16T12:29:16.777313+00:00",{"articles":52},[53,65,76,86],{"slug":54,"title":55,"summary":56,"tags":57,"hero_image_url":62,"story_type":63,"created_at":64},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.",[58,59,60,61,12],"UNC6671","vishing","extortion","BlackFile","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b","campaign","2026-09-22T07:04:26.729885+00:00",{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":73,"story_type":74,"created_at":75},"acronis-tru-details-inc-ransomware-evolution-with-800-victims-and-yara-rules","Acronis TRU details INC ransomware evolution with 800+ victims and YARA rules","Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including full attack chain, YARA rules, and IOCs.",[28,70,71,72,11],"INC","Lynx","Acronis","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Facronis-tru-details-inc-ransomware-evolution-with-800-victims-and-yara-rules.png?v=f32eebbecf","threat_actor_activity","2026-09-04T07:03:39.197374+00:00",{"slug":77,"title":78,"summary":79,"tags":80,"hero_image_url":84,"story_type":74,"created_at":85},"acronis-threat-research-unit-details-inc-ransomware-s-800-victim-run-with-full-a","Acronis Threat Research Unit details INC ransomware's 800+ victim run with full attack chain and YARA rules","Acronis Threat Research Unit publishes a detailed analysis of INC ransomware, tracing its evolution from an emerging RaaS operation to a top-tier group with 800+ victims since 2023, including the full attack chain, YARA rules, and IOCs.",[81,82,83,11,72],"INC Ransomware","CVE-2023-3519","Citrix NetScaler","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Facronis-threat-research-unit-details-inc-ransomware-s-800-victim-run-with-full-a.png?v=da1a5b3d25","2026-09-03T07:04:55.037913+00:00",{"slug":87,"title":88,"summary":89,"tags":90,"hero_image_url":96,"story_type":48,"created_at":97},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware via N-central NCM auth bypass","Microsoft Threat Intelligence identifies a new StormEncryptor ransomware strain deployed by the China-based Storm-1175 actor, which uses CVE-2026-18577 in N-central NCM for initial access and moves from compromise to encryption within days.",[91,92,93,94,95],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f","2026-09-26T07:12:34.821288+00:00"]