crosslock

Executive Summary

CrossLock is a short-lived ransomware group that emerged in April 2023 and disappeared by July 2023. The group uses Go-based ransomware with Curve25519 and ChaCha20 encryption, employing double-extortion tactics. Targeting primarily the IT sector in Brazil, CrossLock has only one confirmed victim to date.

Goals & Targeting

CrossLock operates with the primary goals of financial gain through ransom payments and organizational disruption. The group targets sectors where ransoms are likely to be paid, such as businesses with high data sensitivity or critical operations. Its targeting focus on Brazil suggests either a regional operational capacity or an attempt to exploit specific geographic vulnerabilities. CrossLock's double-extortion tactics indicate a strategic focus on maximizing the psychological impact and financial incentive for victims. The group’s limited activity window (April-July 2023) suggests either early-stage development challenges or external pressures that curtailed their operations.

CrossLock is a newly identified ransomware group that surfaced in April 2023 and was reported inactive by July 2023. The group's operational window was short but impactful, utilizing advanced encryption methods (Curve25519 and ChaCha20) to secure their payloads and employing double-extortion tactics—exfiltrating victim data before encrypting systems. This approach combines traditional ransom demands with the threat of data leaks, a common strategy among modern ransomware groups. Despite its brief activity, CrossLock demonstrates a technical proficiency in encryption and operational tradecraft. The group's targeting focus appears to be on IT sector organizations within Brazil, suggesting either a regional interest or limited operational capacity. CrossLock's rapid rise and fall indicate potential challenges in scaling their operations or maintaining long-term persistence. While the group remains low-profile due to its short lifespan, it is notable for its technical implementation and adherence to emerging ransomware trends.

Key Capabilities

• Go-based ransomware implementation
• Curve25519 encryption algorithm
• ChaCha20 encryption algorithm
• Double-extortion tactics (exfiltration + encryption)
• Limited operational window with high technical focus

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

CrossLock’s campaign activity appears to have been concentrated between April and July 2023, with minimal confirmed victims. The group's rapid emergence and disappearance suggest either a highly specialized operational approach or challenges in maintaining long-term campaigns. Despite its short lifespan, CrossLock demonstrates technical sophistication in encryption methods and double-extortion tactics. Notably, the group did not appear to engage in widespread targeting beyond their single confirmed victim, indicating possible focus on high-value targets within specific sectors or geographies.

IOC Patterns

• Go-based malware signatures associated with ransomware activity
• Network traffic anomalies using Curve25519 encryption
• Double-extortion patterns (data exfiltration + encryption)
• Limited targeting in the IT sector of Brazil

Recommended Actions

• Enhance endpoint detection to identify Go-based malware and suspicious process creations.
• Implement network monitoring for encryption-based anomalies using Curve25519 or ChaCha20 algorithms.
• Strengthen incident response capabilities to detect and mitigate double-extortion activities.
• Conduct regular employee training on phishing and suspicious email protocols.
• Ensure robust backups of critical data systems to mitigate ransomware impacts.

Suggested Tags