[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEN1FkAO5gFNl2qk_VtiKVFx7zmTxRJ3pFr4_Xf-JyTQ":3,"$fpV57W1a0KrAtWSreK-Td962Et1mL1ycYK4t1toEj5EY":72},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":69,"created_at":70,"updated_at":71,"published_at":39},"gdlockersec-claims-attacks-on-nigerian-agency-and-aws-but-evidence-suggests-amat","GDLockerSec Claims Attacks on Nigerian Agency and AWS, but Evidence Suggests Amateur Operation","Investigation reveals the alleged AWS breach stems from a public S3 bucket, contradicting the ransomware group's high-profile claims.","The GDLockerSec ransomware group has claimed responsibility for attacks on a Nigerian government agency and Amazon Web Services in January 2025, yet forensic analysis indicates the operation is amateurish and relies on exaggerated narratives to inflate its reputation within the cybercrime ecosystem.",[10,11,12,13,14],"GDLockerSec","Ransomware","AWS","Nigeria","Cybersecurity Threats","# GDLockerSec Claims Attacks on Nigerian Agency and AWS, but Evidence Suggests Amateur Operation\n\n*Investigation reveals the alleged AWS breach stems from a public S3 bucket, contradicting the ransomware group's high-profile claims.*\n\n**Tags:** `GDLockerSec` `Ransomware` `AWS` `Nigeria` `Cybersecurity Threats`\n\n> The GDLockerSec ransomware group has claimed responsibility for attacks on a Nigerian government agency and Amazon Web Services in January 2025, yet forensic analysis indicates the operation is amateurish and relies on exaggerated narratives to inflate its reputation within the cybercrime ecosystem.\n\n---\n\n## The dual-target claim: Nigeria's LNRBDA and Amazon Web Services\n\nOn January 24, 2025, the ThreatMon intelligence team identified ransomware activity on the dark web attributed to the GDLockerSec group. The operation involved two distinct claims of compromise issued within minutes of one another: the first at 16:42:39 UTC and the second at 16:47:03 UTC. The victims named in these posts were the Nigerian government agency LNRBDA, identified by its domain lnrbda.gov.ng, and Amazon Web Services (AWS), a major global cloud computing platform.\n\nThe proximity of the timestamps suggests a coordinated release of data or claims rather than separate operational incidents. While the group asserted control over systems belonging to both a public sector entity and a private technology giant, independent analysis by KELA Cyber has challenged the validity of the AWS-related allegations. Their investigation determined that the files purportedly leaked from Amazon’s infrastructure originated from an open-source S3 bucket, indicating that the data was publicly accessible rather than stolen through a security breach.\n\n## Debunking the AWS breach: S3 bucket misconfiguration\n\nKELA Cyber’s forensic review of the files attributed to Amazon Web Services revealed that the data originated from a publicly accessible S3 bucket rather than stolen infrastructure. By comparing the sample file released by GDLockerSec against an open-source counterpart, investigators found the content to be identical, confirming that the material was freely available on the internet prior to the alleged leak.\n\nThe analysis concludes that there is no evidence of a security incident or breach at AWS. The group’s claim of compromising Amazon’s systems is therefore unfounded, with the data in question having been sourced from an open repository rather than extracted through malicious intrusion.\n\n## GDLockerSec's origins and operational profile\n\nGDLockerSec emerged in January 2025 as a ransomware operation that initially operated under the alias GhostSec-Devil. The group established its presence through an onion website, adopting infrastructure and communication methods typical of larger ransomware entities. Its digital footprint includes a Tox chat ID used for direct contact with potential victims or affiliates.\n\nThe group’s online activity is heavily concentrated on Telegram, where user @Admfudhsvdg (ID 6527700340) has actively promoted the operation within data breach communities. This individual previously used the username @GDLockerSec and maintains a history of rotating aliases, including @vfsstart, @Bodasec, @vth3darkly, @tradervalide, and @ghostsadmines. Investigations indicate the operator may go by the first name Amin. The group’s reach extends beyond Telegram into Arabian Facebook groups, such as Moroccan Hackers, where inactive profiles linked to the operation have been identified. A message posted in December 2024 within these communities explicitly described the entity as a group targeting computers with ransomware and directed users to contact specific handles for engagement.\n\n## Assessment of threat sophistication and credibility\n\nKELA Cyber characterises GDLockerSec as an amateur operation that relies on exaggerated claims to inflate its standing within the cybercrime ecosystem. The group’s assessment suggests a fundamental lack of sophistication, with tactics that appear to be copied from more established ransomware entities such as RansomHub rather than developed through independent technical innovation. This reliance on imitation and inflated victim lists points to poor operational security and an inability to execute complex intrusions independently.\n\nThe contrast between the group’s bold targeting of high-profile entities, including a government agency and Amazon Web Services, and its actual technical capability is stark. The debunking of the AWS breach—where data was traced to a publicly accessible S3 bucket rather than stolen infrastructure—serves as clear evidence that GDLockerSec lacks the advanced intrusion skills required to compromise such targets. This discrepancy between the group’s public posture and its operational reality underscores its status as a low-sophistication actor attempting to project greater credibility through fabricated claims.\n\n## Key points\n\n- GDLockerSec posted claims of compromising lnrbda.gov.ng and aws.amazon.com on its dark web site within minutes of each other in January 2025.\n- Forensic review determined that the data allegedly stolen from AWS originated from a public S3 bucket, indicating no actual security breach occurred.\n- The group is linked to multiple Telegram aliases and previously operated under the name GhostSec-D, exhibiting poor operational security.\n- Analysts characterize GDLockerSec as an amateur outfit that uses bold claims against high-value targets to attract attention and affiliates rather than demonstrating sophisticated intrusion capabilities.\n\n## Further reading & sources\n\n- [GDLockerSec Ransomware Strikes Again: Government and Tech Giant Targeted in Cyberattacks - UNDERCODE NEWS](https:\u002F\u002Fundercodenews.com\u002Fgdlockersec-ransomware-strikes-again-government-and-tech-giant-targeted-in-cyberattacks)\n- [GDLockerSec Ransomware: 5 Victims, Tactics & Intelligence – TheHackerWire](https:\u002F\u002Fthehackerwire.com\u002Fransomware-groups\u002Fgdlockersec)\n- [Is GDLockerSec Really Targeting AWS? | KELA Cyber](https:\u002F\u002Fkelacyber.com\u002Fblog\u002Fis-gdlockersec-really-targeting-aws)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgdlockersec-claims-attacks-on-nigerian-agency-and-aws-but-evidence-suggests-amat.png?v=797dede701",{"iocs":18,"actors":34,"malware":45,"targets":49,"industries":56,"technologies":63},[19,22,24,26,28,30,32],{"type":20,"value":21},"other","@ghostsadmines",{"type":20,"value":23},"@Bodasec",{"type":20,"value":25},"@vth3darkly",{"type":20,"value":27},"@tradervalide",{"type":20,"value":29},"@Admfudhsvdg",{"type":20,"value":31},"@vfsstart",{"type":20,"value":33},"@GDLockerSec",[35,41],{"url":36,"name":10,"slug":37,"type":38,"origin":39,"motivation":40},"\u002Fthreat-groups\u002Fgdlockersec","gdlockersec","ransomware",null,"financial",{"url":42,"name":43,"slug":44,"type":38,"origin":39,"motivation":40},"\u002Fthreat-groups\u002Fransomhub","RansomHub","ransomhub",[46,48],{"name":47},"GDLockerSec Ransomware",{"name":10},[50,53],{"name":12,"sector":51,"status":52,"geography":39},"Technology","claimed",{"name":54,"sector":55,"status":52,"geography":13},"Nigerian government agency","Government",[57,60],{"url":58,"name":51,"slug":59},"\u002Findustries\u002Ftechnology","technology",{"url":61,"name":55,"slug":62},"\u002Findustries\u002Fgovernment","government",[64,67],{"vendor":65,"product":66},"Amazon","AWS S3",{"vendor":12,"product":68},"Cloud Computing Platform","ransomware_incident","2026-08-18T18:35:26.293755+00:00","2026-10-16T12:29:26.079359+00:00",{"articles":73},[74,85,95,106],{"slug":75,"title":76,"summary":77,"tags":78,"hero_image_url":82,"story_type":83,"created_at":84},"new-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims","New Ransomware Group Linkc Targets H2O.ai with Extortion Claims","A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.",[11,79,80,14,81],"H2O.ai","Data Exfiltration","Extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fnew-ransomware-group-linkc-targets-h2o-ai-with-extortion-claims.png?v=e353bc1862","threat_actor_activity","2026-08-18T18:41:58.855449+00:00",{"slug":86,"title":87,"summary":88,"tags":89,"hero_image_url":93,"story_type":83,"created_at":94},"trend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a","Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics","Trend Micro has detailed the sophisticated tactics of The Gentlemen ransomware group, which leverages legitimate driver abuse and Group Policy Object manipulation to compromise manufacturing, healthcare, and construction sectors globally.",[90,11,91,92,14],"The Gentlemen","Trend Micro","Driver Abuse","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrend-micro-exposes-the-gentlemen-ransomware-group-s-advanced-driver-abuse-and-a.png?v=fb82a8efc1","2026-08-18T18:29:37.334637+00:00",{"slug":96,"title":97,"summary":98,"tags":99,"hero_image_url":104,"story_type":69,"created_at":105},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[100,101,102,11,103],"N-able N-central","CVE-2026-18577","StormEncryptor","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":107,"title":108,"summary":109,"tags":110,"hero_image_url":115,"story_type":69,"created_at":116},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Hits Saudi Chemical Manufacturer","The DragonForce ransomware group has claimed a Saudi Arabian chemical manufacturer, adding to its Q2 2026 run of 144 victims and its ongoing campaign against Gulf-region industrial targets.",[111,11,112,113,114],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00"]