Skip to main content
Darkfield

Operator dossier

Lorenz is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 78 public victims claimed by this operator between January 12, 2020 and December 11, 2023. Lorenz is a ransomware group that emerged in January 2020 and operates primarily for financial gain, having claimed approximately 78 victims across multiple sectors. The group's origin and specific affiliations remain largely undocumented by major threat intelligence organizations, though their targeting patterns suggest a focus on English-speaking nations including the United States, United Kingdom, and Australia. Lorenz primarily targets healthcare, finance, automotive, construction, and retail sectors, suggesting they may opportunistically attack organizations with valuable data and limited security resources rather than following a specific geopolitical agenda. While detailed technical analysis of their attack methodology has not been extensively published by major security firms like Mandiant or government agencies such as CISA, the group appears to follow typical ransomware deployment patterns common to financially-motivated cybercriminal organizations. Public documentation of specific high-profile campaigns, notable victims, or significant law enforcement actions against Lorenz remains limited in open-source intelligence reporting. Based on available victim data extending beyond 2020, the group appears to have maintained some level of operational activity, though comprehensive assessments of their current operational status have not been widely published by authoritative sources in the threat intelligence community.

Most-targeted sectors

Most-affected countries

Recent disclosures by Lorenz

All 78 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Lorenz →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Lorenz

78 victims indexed · first seen 7 years ago · last activity 3 years ago

78
Victims indexed
#83 of 364 tracked operators
3y 11m
Active period
Jan 2020 → Dec 2023
3
Countries hit
top United States · 10

At a glance

Status
inactive
First seen
7 years ago
Last activity
3 years ago
Onion sites
2 known endpoints
Primary sector
Healthcare · 5 hits

About

Lorenz is a ransomware group that emerged in January 2020 and operates primarily for financial gain, having claimed approximately 78 victims across multiple sectors. The group's origin and specific affiliations remain largely undocumented by major threat intelligence organizations, though their targeting patterns suggest a focus on English-speaking nations including the United States, United Kingdom, and Australia. Lorenz primarily targets healthcare, finance, automotive, construction, and retail sectors, suggesting they may opportunistically attack organizations with valuable data and limited security resources rather than following a specific geopolitical agenda. While detailed technical analysis of their attack methodology has not been extensively published by major security firms like Mandiant or government agencies such as CISA, the group appears to follow typical ransomware deployment patterns common to financially-motivated cybercriminal organizations. Public documentation of specific high-profile campaigns, notable victims, or significant law enforcement actions against Lorenz remains limited in open-source intelligence reporting. Based on available victim data extending beyond 2020, the group appears to have maintained some level of operational activity, though comprehensive assessments of their current operational status have not been widely published by authoritative sources in the threat intelligence community.

References

10 links

External sources curated by the MISP threat-intel community.

Timeline

24 months
2021-08-01T00:00:00+00:00 · 12021-09-01T00:00:00+00:00 · 12021-11-01T00:00:00+00:00 · 12021-12-01T00:00:00+00:00 · 22022-01-01T00:00:00+00:00 · 12022-03-01T00:00:00+00:00 · 42022-04-01T00:00:00+00:00 · 62022-05-01T00:00:00+00:00 · 72022-06-01T00:00:00+00:00 · 12022-07-01T00:00:00+00:00 · 62022-08-01T00:00:00+00:00 · 22022-09-01T00:00:00+00:00 · 12022-10-01T00:00:00+00:00 · 22022-11-01T00:00:00+00:00 · 42022-12-01T00:00:00+00:00 · 12023-01-01T00:00:00+00:00 · 32023-02-01T00:00:00+00:00 · 22023-03-01T00:00:00+00:00 · 22023-04-01T00:00:00+00:00 · 52023-08-01T00:00:00+00:00 · 12023-09-01T00:00:00+00:00 · 22023-10-01T00:00:00+00:00 · 22023-11-01T00:00:00+00:00 · 42023-12-01T00:00:00+00:00 · 1
2021-08-01T00:00:00+00:002023-12-01T00:00:00+00:00

Top countries

🇺🇸 United States
10
🇬🇧 United Kingdom
3
🇦🇺 Australia
2
United States dossier →United Kingdom dossier →Australia dossier →

Top sectors

Healthcare
5
Finance
3
Automotive
2
Construction
2
Retail
1
Critical Manufacturing
1
Energy
1
Healthcare dossier →Finance dossier →Automotive dossier →Construction dossier →

MITRE ATT&CK

9 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionLateral MovementCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1021Remote Services
  • T1083File and Directory Discovery
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion
  • http://lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion/

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Lorenz posts a victim.

Add Lorenz to your watchlist — Pro pings you within 5 minutes of any new Lorenz leak-site post, Telegram callout, or affiliate-rebrand inference.