xinglocker
First seen April 29, 2021Active21 claimed victims
The claims below are reproduced as posted by xinglocker on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
XingLocker is a ransomware group that emerged in May 2021 as part of a franchise-style RaaS model built on a customized MountLocker payload, using IcedID for initial access and Windows Active Directory APIs for worm-style lateral movement across networks.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Wayne Automatic Fire Sprinklers, Inc. | October 26, 2021 | ransomware_live | — |
| Tilia GmbH. TILIA GROUP | October 8, 2021 | ransomware_live | — |
| J.Irwin Company | August 17, 2021 | ransomware_live | — |
| DiaSorin | July 8, 2021 | ransomware_live | — |
| Greenwood Fabricating & Plating | June 3, 2021 | ransomware_live | — |
| AQUALUNG | June 2, 2021 | ransomware_live | — |
| Positive Promotions, Inc. | June 2, 2021 | ransomware_live | — |
| Sharafi Group Investments | May 27, 2021 | ransomware_live | — |
| T.I.S. Group | May 24, 2021 | ransomware_live | — |
| Coastal Family Health Center | May 24, 2021 | ransomware_live | — |
| OSF Healthcare System | May 18, 2021 | ransomware_live | — |
| LineStar | May 14, 2021 | ransomware_live | — |
| Solen A.S | May 14, 2021 | ransomware_live | — |
| CBN Logistic | May 14, 2021 | ransomware_live | — |
| Desert Plastering LLC | May 13, 2021 | ransomware_live | — |
| Gulfeagle Supply | May 11, 2021 | ransomware_live | — |
| GlobeMed Saudi | May 6, 2021 | ransomware_live | — |
| Washoe Tribe | May 6, 2021 | ransomware_live | — |
| Bridgelux, Inc. | May 6, 2021 | ransomware_live | — |
| NAVNIT GROUP | April 29, 2021 | ransomware_live | — |
| Pezzuto Group | April 29, 2021 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).