// THREAT ACTOR

RTM-LOCKER_

Active

RTM-LOCKER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of RTM-LOCKER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

0 Victims tracked

1 / 3 Active mirrors

— First listing

— Most recent

Leak site mirrors

3 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

nv4addu4insb7x6aagdv6r5gvxzczgfje7mmecsjonnrvsq7ulevvfid.onion Вход | Read The Manual snapshot · 2025-11-10 13:10
3wugtklp46ufx7dnr6j5cd6ate7wnvnivsyvwuni7hqcqt7hm5r72nid.onion 403 Forbidden snapshot · 2026-08-06 21:33
nvfutdbq3ubteaxj4m2jyihov5aa4akfudsj5h7vhyrvfarfra26ksyd.onion snapshot · 2025-11-05 03:19

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.