Skip to main content
Darkfield

Operator dossier

Lv is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 115 public victims claimed by this operator between November 22, 2021 and March 13, 2024. Lv is a financially motivated ransomware group that emerged in November 2021, operating with relatively low visibility compared to major ransomware families but maintaining consistent activity across multiple regions and sectors. The group's country of origin and specific affiliations remain undocumented in public threat intelligence reporting, though their targeting patterns suggest they operate independently rather than as part of a larger ransomware-as-a-service ecosystem. Limited public documentation exists regarding Lv's specific attack methodology, initial access vectors, or technical capabilities, though their successful compromise of 115 documented victims across diverse sectors indicates they employ conventional ransomware deployment techniques. The group has demonstrated a preference for targeting critical infrastructure and business services, with notable geographic focus on Russia, France, Malaysia, the United States, and the Netherlands, spanning sectors including energy, telecommunications, business services, media, and non-profit organizations. Current intelligence suggests Lv remains active as of recent reporting, though the group maintains a lower profile than prominent ransomware families and has not been subject to major law enforcement disruption operations.

Most-targeted sectors

Most-affected countries

Recent disclosures by Lv

All 115 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Lv →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Lv

115 victims indexed · first seen 5 years ago · last activity 2 years ago

115
Victims indexed
#65 of 364 tracked operators
2y 4m
Active period
Nov 2021 → Mar 2024
10
Countries hit
top Russia · 14

At a glance

Status
inactive
First seen
5 years ago
Last activity
2 years ago
Onion sites
4 known endpoints
Primary sector
Energy · 4 hits

About

Lv is a financially motivated ransomware group that emerged in November 2021, operating with relatively low visibility compared to major ransomware families but maintaining consistent activity across multiple regions and sectors. The group's country of origin and specific affiliations remain undocumented in public threat intelligence reporting, though their targeting patterns suggest they operate independently rather than as part of a larger ransomware-as-a-service ecosystem. Limited public documentation exists regarding Lv's specific attack methodology, initial access vectors, or technical capabilities, though their successful compromise of 115 documented victims across diverse sectors indicates they employ conventional ransomware deployment techniques. The group has demonstrated a preference for targeting critical infrastructure and business services, with notable geographic focus on Russia, France, Malaysia, the United States, and the Netherlands, spanning sectors including energy, telecommunications, business services, media, and non-profit organizations. Current intelligence suggests Lv remains active as of recent reporting, though the group maintains a lower profile than prominent ransomware families and has not been subject to major law enforcement disruption operations.

References

3 links

External sources curated by the MISP threat-intel community.

Timeline

13 months
2021-11-01T00:00:00+00:00 · 62021-12-01T00:00:00+00:00 · 112022-01-01T00:00:00+00:00 · 12022-02-01T00:00:00+00:00 · 42022-04-01T00:00:00+00:00 · 202022-05-01T00:00:00+00:00 · 102022-06-01T00:00:00+00:00 · 82022-07-01T00:00:00+00:00 · 62022-08-01T00:00:00+00:00 · 72022-11-01T00:00:00+00:00 · 162023-12-01T00:00:00+00:00 · 232024-02-01T00:00:00+00:00 · 22024-03-01T00:00:00+00:00 · 1
2021-11-01T00:00:00+00:002024-03-01T00:00:00+00:00

Top countries

🇷🇺 Russia
14
🇫🇷 France
4
🇲🇾 Malaysia
2
🇺🇸 United States
2
🇳🇱 Netherlands
2
🇧🇷 Brazil
2
🇷🇸 Serbia
1
🇨🇿 Czech Republic
1
Russia dossier →France dossier →Malaysia dossier →United States dossier →

Top sectors

Energy
4
Telecommunications
2
Business Services
2
Media
1
Non-Profit
1
Government
1
Finance
1
Healthcare
1
Energy dossier →Telecommunications dossier →Business Services dossier →Media dossier →

MITRE ATT&CK

22 techniques · 10 tactics

Tactics

Command And ControlCredential AccessDefense ImpairmentDiscoveryExecutionInitial AccessLateral MovementPersistencePrivilege EscalationStealth

Techniques

Recent victims

Loading…

Onion infrastructure

4 known
  • http://4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion
  • http://4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion/
  • http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion
  • http://rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion/api/posts/1

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Lv posts a victim.

Add Lv to your watchlist — Pro pings you within 5 minutes of any new Lv leak-site post, Telegram callout, or affiliate-rebrand inference.