crosslock
- First seen
- 2023-04-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-06-26 08:55:27
- Profile updated
- 2026-07-07 13:52:22
Targeted industries: professional-services technology-and-telecommunications
Targeted regions: country_code:br
Context
CrossLock ransomware was first observed in April 2023, targeting an IT services firm in Brazil using a double‑extortion approach—encrypting data and threatening to leak it publicly. Written in Go, it uses a hybrid encryption scheme combining ChaCha20 for file encryption with Curve25519 for key protection. Victims see their files renamed with the .crlk extension and ransom notes titled ---CrossLock_readme_To_Decrypt---.txt. The malware includes advanced techniques like Event Tracing for Windows (ETW) bypass and process mimicking (e.g., Cybereason processes) for stealth. It was publicly tracked until July 2023, after which activity (and its leak site) went offline.
Reports & references
- ransomlook.io — Crosslock (report)
- watchguard.com — Crosslock (report)
- sentinelone.com — Crosslock (report)
- netskope.com — Netskope Threat Coverage Crosslock Ransomware (report)
- cyble.com — Crosslock Ransomware Emerges New Golang Based Malware On The Horizon (report)
- rewterz.com — Rewterz Threat Alert Crosslock Ransomware Active Iocs (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Crosslock (report)
- twitter.com — 1648232869809078273 (report)