lunalock is a ransomware group from 2025 targeting creative platforms with AI-related extortion.
lunalock is a ransomware group that emerged in September 2025, primarily targeting creative and digital platforms such as illustrator marketplaces and ISPs. Their key TTP involves threatening to submit stolen artwork to AI companies for training if the ransom is not paid, leveraging data extortion. Defenders should focus on protecting creative intellectual property and be prepared for unconventional extortion demands beyond traditional data encryption.
LunaLock emerged in September 2025 targeting creative and digital platforms, notably breaching an illustrator marketplace and a Mexican ISP, and is notable for threatening to submit stolen artwork to AI companies for training if the ransom is not paid.
lunalock primarily targets creative and digital platforms, including illustrator marketplaces and Internet Service Providers (ISPs).
Their key tactic is threatening to submit stolen artwork to AI companies for training if the ransom is not paid.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.