SatanLock shuts down, claims 67 victims
SatanLock, also known as satanlockv2, is a short-lived ransomware group that emerged in April 2025 and announced its shutdown in July 2025. The group claims 67 compromised organizations, though over 65% of the listed victims are duplicates from other ransomware groups.
SatanLock uses a double extortion model: it steals data and threatens to leak it if the ransom demand isn't met. The group is based in China and runs its leak site on an Apache 2.4.58 (Win64) server with PHP 8.2.12.
How SatanLock works
SatanLock operates on a double extortion model. The group exfiltrates data from the victim and holds it hostage, threatening to publish it if the ransom demand isn't met. No unique malware or custom tools are attributed to the group; it relies on standard ransomware tactics for execution and lateral movement.
The TTPs map to nine MITRE ATT&CK techniques: T1486 (Fileless Execution), T1490 (Process Injection), T1040 (Data from Information Repository), T1078 (Valid Accounts), T1047 (JavaScript), T1021 (Remote Service), T1562 (Bypass UAC), T1059 (Command and Scripting Interpreter), and T1071 (Application Layer Protocol). The leak site runs on an Apache 2.4.58 (Win64) server with PHP 8.2.12, hosted at tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion.
Who was hit
Victims span six sectors: Business Services, Education, Healthcare, Professional Services, Retail & E-Commerce, and Technology. The group claims 67 total victims, with five confirmed on RansomwareRadar and four on Ransomware.live.
Notable targets include Klinik Dr. Indrajana, an Indonesian healthcare provider, Teligent, a Swedish firm, and a US-based Retail & E-Commerce organization. The US target is the only one outside the three primary countries.
Geographically, victims are concentrated in Indonesia, Thailand, and Italy, with one organization in each country. The group is based in China.
The data leak
SatanLock announced a data leak upon shutdown, a move that distinguishes it from most short-lived ransomware groups that simply vanish. The leak site is a PHP 8.2.12 application running on Apache 2.4.58 (Win64) with OpenSSL 3.1.3, hosted at tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion.
The group published nine SHA-256 hashes and one hostname IOC, along with a YARA rule (satanlockv2.yar) for detection. The TTPs total ten, covering the nine MITRE ATT&CK techniques listed in the previous section.
Key points
- SatanLock (sanlockv2) emerged in April 2025 and shut down in July 2025 after ~6 months of operations.
- Group claims 67 compromised organizations, with over 65% of listed victims being duplicates from other groups.
- Uses double extortion: steals data and threatens to leak if ransom isn't paid.
- Victims span Education, Financial Services, Healthcare, Hospitality, Manufacturing, and other sectors.
- Leak site runs on Apache 2.4.58 (Win64) with PHP 8.2.12, accessible via .onion.