Loading threat actor…
Lockean is a financially motivated ransomware affiliate group active since at least 2020 and notably associated with intrusions against French companies. Rather than operating a single proprietary ransomware strain, Lockean functioned as a multi-RaaS affiliate and deployed payloads from several ransomware ecosystems, including DoppelPaymer, Maze, Egregor, ProLock, and REvil. The group used a double-extortion model, stealing victim data prior to encryption and monetizing intrusions through ransom payments while sharing proceeds with ransomware operators. Lockean commonly obtained initial access through malware distribution chains involving Qbot/QakBot, including access delivered via Emotet before its disruption and later via TA551. At least one intrusion was associated with IcedID-based access. Post-compromise activity included use of Cobalt Strike for hands-on intrusion operations, AdFind and BloodHound for reconnaissance and Active Directory mapping, BITSadmin for operational support, and Rclone for data exfiltration. Reported victimology includes organizations in transportation, media, manufacturing, and pharmaceuticals. Lockean is best understood as an affiliate cluster within the broader cybercriminal ransomware ecosystem rather than a standalone ransomware brand. Its operations demonstrate flexible alignment with multiple ransomware-as-a-service programs and collaboration with upstream access providers such as TA551. High-confidence reporting ties the group to repeated compromises of French enterprises over an extended period, with indications it may have operated beyond France as well, though broader geographic scope is less firmly established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware gang that used TA551 distribution services after the Emotet takedown.
A ransomware operation whose affiliates collaborated with TA551 to deploy multiple ransomware payloads on Qbot/QakBot-infected devices.
A multi-RaaS ransomware affiliate that compromised at least eight French companies, stole data, and deployed multiple ransomware families including DoppelPaymer, Maze, Egregor, ProLock, and REvil. The group used double extortion and common post-compromise tooling for lateral movement and data theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.