crosslock Ransomware
Tracked since Apr 17, 2023
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
CrossLock is a short-lived Go-based ransomware group that appeared in April 2023 and went dark by July 2023, using Curve25519 and ChaCha20 encryption and double-extortion tactics with only one known confirmed victim in the IT sector in Brazil.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Execution
T1059 Command and Scripting Interpreter Privilege Escalation
T1548 Abuse Elevation Control Mechanism Defense Evasion
T1055 Process InjectionT1070 Indicator Removal Discovery
T1007 System Service DiscoveryT1057 Process DiscoveryT1083 File and Directory Discovery Lateral Movement
T1021 Remote Services Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live