Ransomware group profile · #77 by claimed victims
Lorenz ransomware
Tesorion describes Lorenz as a ransomware with design and implementation flaws, leading to impossible decryption with tools provided by the attackers. A free decryptor for 2021 versions was made available via the NoMoreRansom initiative. A new version of the malware was discovered in March 2022, for which again was provided a free decryptor, while the ransomware operators are not able to provide tools to decrypt affected files.
Victimology
Who Lorenz claims to have breached, from 78 leak-site posts recorded by VULONE.
Claims per month last 12 months
Top sectors
Top countries
Latest claimed victims 12 most recent
| Victim | Sector | Country | Claimed |
|---|---|---|---|
| Bayer Heritage Federal Credit Union bayerhfcu.org | Financial Services | — | 11 Dec 2023 |
| EOS | Not Found | — | 15 Nov 2023 |
| Koh Brothers | Manufacturing | — | 9 Nov 2023 |
| Cogdell Memorial Hospital cogdellhospital.com | Healthcare | US | 9 Nov 2023 |
| Truck Bodies & Equipment International | Transportation | — | 7 Nov 2023 |
| Broad River Retail/Ashley Store | Retail & E-Commerce | — | 25 Oct 2023 |
| AllCare Pharmacy | Healthcare | — | 2 Oct 2023 |
| BF&S Civil Engineers | Professional Services | — | 12 Sep 2023 |
| Dee Sign | Other | — | 12 Sep 2023 |
| Felling Trailers, Inc. felling trailers, inc. | Manufacturing | — | 30 Aug 2023 |
| Tarolli, Sundheim, Covell & Tummino LLP tarolli.com | Financial Services | — | 5 Apr 2023 |
| Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa joycone.com | Agriculture and Food Production | — | 5 Apr 2023 |
All 78 Lorenz victims, searchable
Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.
Tactics, techniques and procedures
ATT&CK technique mapping for Lorenz is in progress. Victimology, infrastructure status and leak-site tracking are live above.
Indicators, detections and the full playbook
Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.
Frequently asked
Is Lorenz ransomware still active?
How many victims has Lorenz claimed?
Which industries does Lorenz target?
Which countries are most affected by Lorenz?
Where does VULONE get Lorenz victim data?
Other ransomware groups
Qilin
Lockbit3
Akira
ClopVictim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].
