// THREAT ACTOR

XINGLOCKER_

Dormant

XINGLOCKER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of XINGLOCKER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

21 Victims tracked

0 / 12 Active mirrors

2021-04-29 First listing

2021-10-26 Most recent

Victims by year

2021 21

Leak site mirrors

12 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

xingnewj6m4qytljhfwemngm7r7rogrindbq7wrfeepejgxc3bwci7qd.onion 星Team News snapshot · 2022-01-24 07:04
zckdr5wmbzxphoem77diqb2ome2a54o23jl2msz3kmotjlpdnjhmn6yd.onion snapshot · 2025-03-22 14:51
duxht3zdnb2dmq34o5w3tyzpy2kgylidnpaxsn2a7lcxoofb6hqmu7qd.onion snapshot · 2025-08-13 01:29
hceesrsg6f5p4gcph4j6jv6vl4mkmaik735oz4r45lgjfyedsxfoprad.onion snapshot · 2025-08-13 01:30
qfgh2lpslhjb33z3wsenmqrxcdragelinvcpowlgkbjca6yig5zloeyd.onion snapshot · 2025-08-13 01:32
tpze4yo74m6qflef.onion snapshot · 2025-08-13 01:32
ikrah6fb4e6r2raxkyvyoxp22jam5z6ak5ajfnzxutmassoagvr2bhad.onion snapshot · 2025-08-13 01:33
ibih5znjxf2cqgo737xmooyvmxhac45wd4rivh6n5hd7fysn42g3fayd.onion snapshot · 2025-08-13 01:33
z4cn6lpet4y4r6mdlbpklpcrjdruwb6kiuvxn6gsiuoub23z6prlx6ad.onion snapshot · 2025-08-13 01:33
yk7erwdvj4vxcgiq3gmcufkben4bk4ixddl5j2xvu7gurtdq754jmiad.onion snapshot · 2025-08-13 01:34
3klsbd4dwj3yqgo4xpogfgwqkljbnbdxjryeqks2cjion5jj33wvkqyd.onion snapshot · 2025-08-13 01:35
x4mjvffmytkw3hyu.onion snapshot · 2025-08-13 01:35

Recent victims

The 50 most recent victims claimed by XINGLOCKER. Total in the index: 21.

Date listed	Victim	Description
2021-10-26	Wayne Automatic Fire Sprinklers, Inc.
2021-10-08	Tilia GmbH. TILIA GROUP
2021-08-17	J.Irwin Company
2021-07-08	DiaSorin
2021-06-03	Greenwood Fabricating & Plating
2021-06-02	Positive Promotions, Inc.
2021-06-02	AQUALUNG
2021-05-27	Sharafi Group Investments
2021-05-24	Coastal Family Health Center
2021-05-24	T.I.S. Group
2021-05-18	OSF Healthcare System
2021-05-14	Solen A.S
2021-05-14	CBN Logistic
2021-05-14	LineStar
2021-05-13	Desert Plastering LLC
2021-05-11	Gulfeagle Supply
2021-05-06	GlobeMed Saudi
2021-05-06	Washoe Tribe
2021-05-06	Bridgelux, Inc.
2021-04-29	Pezzuto Group
2021-04-29	NAVNIT GROUP

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.