Ransomware Group
Xinglocker
XingLocker is a ransomware group that emerged in May 2021 as part of a franchise-style RaaS model built on a customized MountLocker payload, using IcedID for initial access and Windows Active Directory APIs for worm-style lateral movement across networks.
Known victims21
Threat level
MEDIUM
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
DiscoveryEnum
- AdFind
- Bloodhound
- PowerView
- ShareFinder
Offsec
- Cobalt Strike
Known infrastructure
The following Tor hidden services have been associated with this group:
星Team News
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Xinglocker’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request