[AILOCK] - Ransomware Victim: Restorative Therapies, Inc[.] - https://www.redpacketsecurity.com/ailock-ransomware-victim-restorative-therapies-inc/

#ailock #dark_web #data_breach #OSINT #ransomware #threatintel #tor

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

The Gentlemen is a ransomware-as-a-service operation tracked as Storm-2697, distinguished by combining robust per-file encryption using Curve25519 with XChaCha20 stream cipher alongside aggressive self-propagation capabilities designed for broad network compromise. Emerging in mid-2025 and transitioning to RaaS by September 2025, the operation recently partnered with BreachForums to recruit affiliates including penetration testers and initial access brokers. Written in Go and obfuscated with Garble, the ransomware employs double extortion tactics, encrypting data while exfiltrating sensitive information. It utilizes 21 distinct lateral movement techniques per target host, including PsExec, WMI, scheduled tasks, services, and PowerShell remoting. The malware disables defenses, deletes shadow copies and forensic artifacts, and can optionally wipe free disk space to prevent recovery, impacting organizations globally across education, transportation, healthcare, and finance sectors.

Pulse ID: 6a189defc88ad66cd0a9d87d
Pulse Link: https://otx.alienvault.com/pulse/6a189defc88ad66cd0a9d87d
Pulse Author: AlienVault
Created: 2026-05-28 19:56:31

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#ChaCha20 #CyberSecurity #ELF #Education #Encryption #Extortion #Healthcare #ICS #InfoSec #Malware #OTX #OpenThreatExchange #PowerShell #PsExec #RAT #RaaS #RansomWare #RansomwareAsAService #bot #AlienVault

🚨New ransom group blog post!🚨

Group name: AiLock
Post title: Restorative Therapies, Inc.
Info: https://cti.fyi/groups/AiLock.html

#ransomware #cti #threatintelligence #cybersecurity #infosec

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor - https://www.redpacketsecurity.com/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/

#threatintel
#ransomware
#cybersecurity
#Go
#lateral-movement
#encryption