SatanLock (satanlockv2) is a short-lived ransomware group known for data leaks.
SatanLock (satanlockv2) is a short-lived ransomware group that appeared in April 2025 and abruptly shut down in July 2025. The group targeted organizations across various sectors, though over 65% of its claimed victims were likely duplicated from other ransomware groups' leak sites. Key TTPs include ransomware deployment, data exfiltration, and the full public leaking of all stolen data upon group shutdown. Defenders should immediately check leak databases for potential exposure of their organization's data and reinforce network segmentation and backup strategies against ransomware.
SatanLock is a short-lived ransomware group that first appeared in April 2025 and abruptly shut down in July 2025 after claiming attacks against roughly 67 organizations — though over 65% of listed victims were duplicates from other groups — leaking all stolen data publicly upon shutdown.
SatanLock appeared in April 2025 and abruptly shut down in July 2025.
Over 65% of SatanLock's claimed victims were likely duplicated from other ransomware groups' leak sites.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.