satanlockv2 is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 4 public victims claimed by this operator between July 4, 2025 and July 7, 2025. Based on publicly available information, satanlockv2 is a newly emerged ransomware group first observed in July 2025 with limited documented activity, having claimed only four known victims to date, suggesting either early-stage operations or a small-scale operation with financial motivations typical of ransomware actors. The group's origin and potential affiliations remain unclear due to insufficient public documentation by major cybersecurity firms or law enforcement agencies, though their recent emergence and naming convention following the "v2" pattern suggests they may be either a rebrand of a previous operation or an evolution of earlier ransomware variants. Their attack methodology and specific technical capabilities have not been extensively documented by reputable security researchers, though their targeting pattern shows a geographic focus on Indonesia, Thailand, and Italy, with victim organizations spanning healthcare and education sectors alongside other unspecified industries. No notable high-profile campaigns, significant ransom demands, or law enforcement actions have been publicly reported against this group by CISA, FBI, or major security firms like Mandiant. Given the limited intelligence available and their recent emergence in July 2025, satanlockv2 appears to currently remain active but operates at a relatively low profile compared to established ransomware groups.

Recent disclosures by satanlockv2

All 4 indexed disclosures. Click any row for the full per-victim dossier.

• Satanlock project will be shut downNot Found · July 7, 2025
• https://klinikdrindrajana.com/Healthcare · ID · July 6, 2025
• fkk.ac.thEducation · TH · July 4, 2025
• studionotarile.comNot Found · Italy · July 4, 2025

See every disclosure indexed for satanlockv2 →