Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

LORENZ · Threat actor profile

// THREAT ACTOR

LORENZ_

Dormant

LORENZ is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of LORENZ — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

98 Victims tracked
0 / 4 Active mirrors
2020-01-12 First listing
2023-12-11 Most recent

Victims by year

  • 2023 22
  • 2022 55
  • 2021 19
  • 2020 2

Leak site mirrors

4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion Lorenz snapshot · 2024-08-14 23:08
  • woe2suafeg6ehxivgvvn4nh6ectbdhdqgc4vzph27mmyn7rjf2c52jid.onion snapshot · 2024-07-16 19:29
  • lorenzedzyzyjhzxvlcv347n5piltxamo755pzqpozh5l47kj7mxueid.onion snapshot · 2024-12-10 04:56
  • lorenzezzwvtk3y24wfph4jpho27grrctqvf6yvld7256rnoz7yg2eid.onion snapshot · 2024-12-10 04:57

Recent victims

The 50 most recent victims claimed by LORENZ. Total in the index: 98.

Date listed Victim Description
2023-12-11 Bayer Heritage Federal Credit Union
2023-11-15 EOS
2023-11-09 Koh Brothers
2023-11-09 Cogdell Memorial Hospital
2023-11-07 Truck Bodies & Equipment International
2023-10-25 Broad River Retail/Ashley Store
2023-10-02 AllCare Pharmacy
2023-09-12 BF&S Civil Engineers
2023-09-12 Dee Sign
2023-08-30 Felling Trailers, Inc.
2023-04-05 Tarolli, Sundheim, Covell & Tummino LLP
2023-04-05 Joy Cone Co, Joy Baking group, BoDeans Baking, Altesa
2023-04-05 NGS Super
2023-04-05 Intrasect Technologies
2023-04-05 Moore Engineering
2023-03-14 Manning Building Supplies
2023-03-14 Tarolli
2023-02-20 Hopsteiner
2023-02-06 AmerisourceBergen/Censora - MWI Animal Health
2023-01-10 Chestertons Inc.
2023-01-10 Thor Specialties, Inc.
2023-01-10 Shelco
2022-12-07 Albina Asphalt
2022-11-30 Holler-Classic
2022-11-14 Nissan of Las Cruces
2022-11-14 Salud Family Health
2022-11-10 Main & Main Capital Group
2022-10-27 Miracapo pizza company
2022-10-18 Wes-tec inc.
2022-09-17 Turner Enterprises, Inc.
2022-09-17 Ward Hadaway
2022-09-17 Northern Contours Inc.
2022-09-17 Laddawn Inc.
2022-08-23 Engine Power
2022-08-22 Northern Contours
2022-08-18 Airtech
2022-08-18 Tygavac
2022-08-18 Wolfe Eye Clinic
2022-08-18 Challenge-mfg
2022-08-18 Turner Enterprises
2022-08-18 Hensoldt
2022-08-18 VadaTech
2022-08-18 Wardhadaway
2022-08-18 DeeZee
2022-08-18 Musco
2022-08-18 Tosoh
2022-08-18 Brunk
2022-08-18 Fuji
2022-08-18 Bonneville
2022-08-18 Wis-Pak

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.