Ransomware needs a way in. Stolen credentials are the cheapest one.
satanlockv2 Ransomware Group
Ransomware group profile
Description
SatanLock, also known as satanlockv2, was a ransomware group that emerged in early 2025 and ceased operations by July 2025. With a focus on data theft and extortion instead of traditional file encryption, the group claimed to have compromised 67 organizations and intended to publicly leak stolen data upon shutdown.
Key insights
- •SatanLock primarily employed a double extortion model, threatening to leak stolen data if ransom demands were not met.
- •The group rapidly compromised 67 organizations shortly after its inception, indicating a high level of operational efficiency.
- •SatanLock potentially shared victim pools with other ransomware groups, suggesting connections to broader cybercriminal networks.
- •Despite its short lifespan, the group made headlines due to its unique approach to handling ransom demands by announcing a data leak upon cessation.
- •No specific malware or unique tools were attributed to SatanLock, indicating reliance on common ransomware tactics.
Threat Level & Status Breakdown
For satanlockv2 · Based on incidents in selected period
No victim data for this group in the selected period.
No recent activity in the selected period.
Intelligence
IOCs, YARA/Sigma rules, and related families for satanlockv2
- 425d28263b9cea66a259a86f0fca620f
- 49c720758b8a87e42829ffb38a0d7fe2a8c36dc3007abfabbea76155185d2902
- 95cb337dbb1f77fa8fb1b823f62e6419e92625f8
- 89a54d3a38d2364784368a40ab228403f1f1c1926892fe8355aa29d00eb36819
- 4538232bfc2fc58bbcace6e3821d5e75
- f5e122b60390bdcc1a17a24cce0cbca68475ad5abee6b211b5be2dea966c2634
- b9d1464bbffadb05228f29a3d75dc78f22a24b57
- 964540e24c4e2e048e4600e5f590bf96
- 4f88d3977a24fb160fc3ba69821287a197ae9b04493d705dc2fe939442ba6461
- d4757f035c3447c33c2347101d08c1e798f1a044
- 32d489eef7cbbdf51dc41d07648d7d8f
- 1ea37e077e6b2463b8440065d5110377e2b4b4283ce9849ac5efad6d664a8e9e
- 570a0e5e82568202d25c951596db8e3f563d8446
- cce52f8d5fcdf83d6f89de141b62115c
- 0303f89829763e734b1f9d4f46671e59bfaa1be5d8ec84d35a203efbfcb9bb15
- 0e57736f291d5953bfc01ea8ebdc625d0b61484c
- 10700ee5caad40e74809921e11b7e3f2330521266c822ca4d21e14b22ef08e1d
- afa927ca549aaba66867f21fc4a5d653884c349f8736ecc5be3620577cf9981f
- d2539173bdc81503bf1b842a21d9599948e957cadc76a283a52f5849323d8e04
- 031c4fcdce5a18eb6a144bd7602153ab
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for satanlockv2
T1486
T1486
T1490
T1490
T1040
T1040
T1078
T1078
T1047
T1047
T1021
T1021
T1562
T1562
T1059
T1059
T1071
T1071
T1021.001
T1021.001
Affected countries(16)
Countries where this group has been reported to target or leak victims.