AiLock is a Ransomware-as-a-Service (RaaS) group that first emerged in March 2025, operating a double-extortion model to coerce victims into paying ransoms. This group is distinguished by its aggressive negotiation tactics, imposing tight deadlines of 72 hours for initial response and five days for payment, after which they threaten to publicly leak stolen data, report breaches to regulators, or share information with victims' competitors, and even destroy recovery tools. Their ransomware uses a hybrid encryption scheme combining ChaCha20 for file encryption with NTRUEncrypt for metadata protection, and is designed with a multi-threaded architecture utilizing I/O Completion Ports (IOCP) to maximize encryption efficiency. While the group actively recruits affiliates and operates data leak sites, their specific country of origin or leadership is not publicly disclosed.

Paises afectados

Sectores atacados

URLs nuevas detectadas en IntelTracker