Loading threat actor…
MorLock is a cybercriminal threat actor associated with ransomware activity targeting organizations in Russia. It has been linked through tooling, infrastructure, and tradecraft overlaps with other Russia-targeting clusters including Crypt Ghouls, BlackJack, Twelve, and Shedding Zmiy (ExCobalt), suggesting collaboration, shared tooling, or shared operational resources rather than cleanly distinct boundaries between groups. Observed overlaps include use of credential-harvesting utilities, remote access and tunneling tools, network reconnaissance software, proxy tooling, and common naming conventions and infrastructure patterns. MorLock has been associated with intrusions that culminate in deployment of LockBit 3.0 on Windows systems and Babuk on Linux and ESXi environments. The broader activity cluster tied to MorLock-like operations includes abuse of compromised credentials for access, persistence through service creation and tunneling utilities, credential theft from memory and browsers, reconnaissance of Active Directory and internal networks, remote execution over administrative protocols, and lateral movement across victim environments. The actor’s operations indicate financially motivated ransomware objectives, with attacks designed to disrupt victim operations and extort payment. Available reporting directly supports MorLock’s similarity to these campaigns and its participation in the same Russia-focused ransomware ecosystem, but does not clearly delimit MorLock as a fully separate organization from the overlapping clusters.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Group targeting Russia with a toolkit and infrastructure overlapping heavily with Crypt Ghouls, including shared utilities, ransomware families, naming conventions, and VPN/hosting providers.
Referenced as a related ransomware intrusion cluster with overlapping tooling, naming conventions, and infrastructure with Crypt Ghouls, suggesting possible resource sharing or collaboration.
Referenced as a separate group conducting similar recent campaigns targeting Russia with overlapping tools/infrastructure; no additional details provided in the content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.