Threat Group Profile
AiLock
● Active — last 30 days
Victim claims
19
First seen
Apr 2026
Last activity
09 Jul 2026
Tracked since
Mar 2026
Group overview
AiLock is a ransomware operation that emerged in early 2025, marketing itself as AI-assisted ransomware using a hybrid ChaCha20/NTRUEncrypt encryption scheme and double-extortion tactics, actively recruiting affiliates and threatening regulatory reporting if ransoms are unpaid.
Preferred targets
Business Services · 5
Manufacturing · 4
Consumer Services · 3
Education · 1
Healthcare · 1
Technology · 1
Most targeted countries
US · 8
DE · 2
MX · 1
IT · 1
CL · 1
FR · 1
