LV

LV is a ransomware threat actor associated with use of a modified REvil encryptor. Reporting has linked the group to patching REvil’s malware so that victims are encrypted with LV-controlled keys, indicating operational overlap with the broader post-REvil ransomware ecosystem. LV has been identified among active ransomware groups operating leak-site-based extortion models. The group has been observed abusing valid domain credentials, including compromised domain administrator accounts, to obtain domain admin privileges inside victim environments. This supports assessed capabilities in initial access through credential abuse, privilege escalation, persistence, lateral movement, and post-compromise operations conducted through legitimate accounts rather than software exploitation. The actor’s tradecraft is consistent with enterprise ransomware intrusion patterns centered on Active Directory compromise and broad control of Windows domains. LV is financially motivated and operates as a criminal ransomware actor rather than a state-sponsored espionage group. High-confidence public reporting in the supplied material does not establish a specific country of origin, named sub-groups, or a clearly attributed victim geography beyond general ransomware activity.