AiLock is a criminal ransomware group from 2025 known for AI-assisted attacks and double-extortion tactics.
Analyst brief
AiLock is a criminal ransomware group that emerged in early 2025, marketing itself as AI-assisted. It primarily targets Manufacturing, Technology, and Retail sectors across Japan, the US, Germany, and other countries. The group uses a hybrid ChaCha20/NTRUEncrypt encryption scheme and double-extortion tactics, threatening to report data leaks to regulators if ransoms go unpaid. Defenders should focus on the affiliate recruitment model, isolate backups, and prepare incident response for data exfiltration threats.
AiLock
activecrime
AiLock is a ransomware operation that emerged in early 2025, marketing itself as AI-assisted ransomware using a hybrid ChaCha20/NTRUEncrypt encryption scheme and double-extortion tactics, actively recruiting affiliates and threatening regulatory reporting if ransoms are unpaid.