[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fC7zkB_KKRyVHEF3mp-pOXmEyZYQ2GovQ6V05Jw6k-Zw":3,"$fn0211YmjauQC-R5o9s5Lj4hrqOc_e0lIUaDObB_qMz0":76},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":73,"created_at":74,"updated_at":75,"published_at":27},"satanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims","SatanLock ransomware group shuts down after six months, claims 67 victims","SatanLock (sanlockv2) announces shutdown and data leak of 67 organizations after a short operational run from April to July 2025.","SatanLock, a double-extortion ransomware group, has ceased operations after roughly six months, claiming 67 compromised organizations and leaking stolen data.",[10,11,12,13,14],"ransomware","SatanLock","sanlockv2","data leak","double extortion","# SatanLock ransomware group shuts down after six months, claims 67 victims\n\n*SatanLock (sanlockv2) announces shutdown and data leak of 67 organizations after a short operational run from April to July 2025.*\n\n**Tags:** `ransomware` `SatanLock` `sanlockv2` `data leak` `double extortion`\n\n> SatanLock, a double-extortion ransomware group, has ceased operations after roughly six months, claiming 67 compromised organizations and leaking stolen data.\n\n---\n\n## SatanLock shuts down, claims 67 victims\n\nSatanLock, also known as satanlockv2, is a short-lived ransomware group that emerged in April 2025 and announced its shutdown in July 2025. The group claims 67 compromised organizations, though over 65% of the listed victims are duplicates from other ransomware groups.\n\nSatanLock uses a double extortion model: it steals data and threatens to leak it if the ransom demand isn't met. The group is based in China and runs its leak site on an Apache 2.4.58 (Win64) server with PHP 8.2.12.\n\n## How SatanLock works\n\nSatanLock operates on a double extortion model. The group exfiltrates data from the victim and holds it hostage, threatening to publish it if the ransom demand isn't met. No unique malware or custom tools are attributed to the group; it relies on standard ransomware tactics for execution and lateral movement.\n\nThe TTPs map to nine MITRE ATT&CK techniques: T1486 (Fileless Execution), T1490 (Process Injection), T1040 (Data from Information Repository), T1078 (Valid Accounts), T1047 (JavaScript), T1021 (Remote Service), T1562 (Bypass UAC), T1059 (Command and Scripting Interpreter), and T1071 (Application Layer Protocol). The leak site runs on an Apache 2.4.58 (Win64) server with PHP 8.2.12, hosted at tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion.\n\n## Who was hit\n\nVictims span six sectors: Business Services, Education, Healthcare, Professional Services, Retail & E-Commerce, and Technology. The group claims 67 total victims, with five confirmed on RansomwareRadar and four on Ransomware.live.\n\nNotable targets include Klinik Dr. Indrajana, an Indonesian healthcare provider, Teligent, a Swedish firm, and a US-based Retail & E-Commerce organization. The US target is the only one outside the three primary countries.\n\nGeographically, victims are concentrated in Indonesia, Thailand, and Italy, with one organization in each country. The group is based in China.\n\n## The data leak\n\nSatanLock announced a data leak upon shutdown, a move that distinguishes it from most short-lived ransomware groups that simply vanish. The leak site is a PHP 8.2.12 application running on Apache 2.4.58 (Win64) with OpenSSL 3.1.3, hosted at tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion.\n\nThe group published nine SHA-256 hashes and one hostname IOC, along with a YARA rule (satanlockv2.yar) for detection. The TTPs total ten, covering the nine MITRE ATT&CK techniques listed in the previous section.\n\n## Key points\n\n- SatanLock (sanlockv2) emerged in April 2025 and shut down in July 2025 after ~6 months of operations.\n- Group claims 67 compromised organizations, with over 65% of listed victims being duplicates from other groups.\n- Uses double extortion: steals data and threatens to leak if ransom isn't paid.\n- Victims span Education, Financial Services, Healthcare, Hospitality, Manufacturing, and other sectors.\n- Leak site runs on Apache 2.4.58 (Win64) with PHP 8.2.12, accessible via .onion.\n\n## Further reading & sources\n\n- [satanlockv2 - Ransomware Group | RansomwareRadar | SOCRadar](https:\u002F\u002Fsocradar.io\u002Ffree-tools\u002Fransomware-intelligence\u002Fgroups\u002Fsatanlockv2)\n- [Ransomware.live: satanlockv2](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fsatanlockv2)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsatanlock-ransomware-group-shuts-down-after-six-months-claims-67-victims.png?v=99e2fb1938",{"iocs":18,"actors":22,"malware":28,"targets":30,"industries":36,"techniques":40},[19],{"type":20,"value":21},"domain","tzhwmgguyxrg6q3tu4q3gvopcjynrhw6ryx2bdl5ghisdkyunfua5xyd.onion",[23],{"url":24,"name":25,"slug":26,"type":10,"origin":27,"motivation":27},"\u002Fthreat-groups\u002Fsatanlock","Satanlock","satanlock",null,[29],{"name":11},[31],{"name":32,"sector":33,"status":34,"geography":35},"Klinik Dr. Indrajana","Healthcare","claimed","Indonesia",[37],{"url":38,"name":33,"slug":39},"\u002Findustries\u002Fhealthcare","healthcare",[41,45,49,53,57,61,65,69],{"id":42,"url":43,"name":44},"T1021","\u002Fmitre-attack\u002Ftechniques\u002FT1021","Remote Services",{"id":46,"url":47,"name":48},"T1071","\u002Fmitre-attack\u002Ftechniques\u002FT1071","Application Layer Protocol",{"id":50,"url":51,"name":52},"T1059","\u002Fmitre-attack\u002Ftechniques\u002FT1059","Command and Scripting Interpreter",{"id":54,"url":55,"name":56},"T1047","\u002Fmitre-attack\u002Ftechniques\u002FT1047","Windows Management Instrumentation",{"id":58,"url":59,"name":60},"T1490","\u002Fmitre-attack\u002Ftechniques\u002FT1490","Inhibit System Recovery",{"id":62,"url":63,"name":64},"T1040","\u002Fmitre-attack\u002Ftechniques\u002FT1040","Network Sniffing",{"id":66,"url":67,"name":68},"T1078","\u002Fmitre-attack\u002Ftechniques\u002FT1078","Valid Accounts",{"id":70,"url":71,"name":72},"T1486","\u002Fmitre-attack\u002Ftechniques\u002FT1486","Data Encrypted for Impact","ransomware_incident","2026-08-26T12:10:42.22722+00:00","2026-10-16T12:29:21.447404+00:00",{"articles":77},[78,89,99,111],{"slug":79,"title":80,"summary":81,"tags":82,"hero_image_url":87,"story_type":73,"created_at":88},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[83,84,85,13,86,10],"Silent Ransom Group","Troutman Pepper Locke","law firm","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":90,"title":91,"summary":92,"tags":93,"hero_image_url":97,"story_type":73,"created_at":98},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[94,95,10,14,96],"Dark Project","Brainhunter","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00",{"slug":100,"title":101,"summary":102,"tags":103,"hero_image_url":109,"story_type":73,"created_at":110},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[10,104,105,106,107,108],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":112,"title":113,"summary":114,"tags":115,"hero_image_url":120,"story_type":73,"created_at":121},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.",[10,116,117,118,119],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00"]