Ransomware group profile · #169 by claimed victims

Xinglocker ransomware

XingLocker is a ransomware group that emerged in May 2021 as part of a franchise-style RaaS model built on a customized MountLocker payload, using IcedID for initial access and Windows Active Directory APIs for worm-style lateral movement across networks.

Active First seen Apr 2021

21Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

1Countries hit

12Leak-site URLs tracked, 0 online

26 Oct 2021Latest claim recorded

Victimology

Who Xinglocker claims to have breached, from 21 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Manufacturing5

Healthcare4

Professional Services2

Financial Services2

Other1

Transportation1

Energy & Utilities1

Technology1

Top countries

United States2

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
Wayne Automatic Fire Sprinklers, Inc. wayne automatic fire sprinklers, inc.	Manufacturing	-	26 Oct 2021
Tilia GmbH. TILIA GROUP tilia gmbh. tilia group	Manufacturing	-	8 Oct 2021
J.Irwin Company j.irwin company	Other	-	17 Aug 2021
DiaSorin	Healthcare	-	8 Jul 2021
Greenwood Fabricating & Plating	Manufacturing	-	3 Jun 2021
Positive Promotions, Inc. positive promotions, inc.	Professional Services	-	2 Jun 2021
AQUALUNG	Manufacturing	-	2 Jun 2021
Sharafi Group Investments	Financial Services	-	27 May 2021
T.I.S. Group t.i.s. group	Not Found	-	24 May 2021
Coastal Family Health Center	Healthcare	-	24 May 2021
OSF Healthcare System	Healthcare	-	18 May 2021
Solen A.S solen a.s	Not Found	-	14 May 2021

All 21 Xinglocker victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Xinglocker is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Xinglocker ransomware still active?

Xinglocker is tracked as active. The most recent leak-site claim VULONE recorded is dated 26 October 2021.

How many victims has Xinglocker claimed?

VULONE has recorded 21 leak-site victim claims attributed to Xinglocker since April 2021, across 1 countries and 10 sectors.

Which industries does Xinglocker target?

The sectors most often named on the Xinglocker leak site are Manufacturing, Healthcare, Professional Services.

Which countries are most affected by Xinglocker?

Most Xinglocker victims recorded by VULONE are located in United States.

Where does VULONE get Xinglocker victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 31 October 2026. Questions or corrections: research@vulone.com.