AiLock ransomware

AiLock is a double-extortion ransomware family, active since spring 2025, that appends .ailock to encrypted files and places a text note called ReadMe.txt in affected folders. The note opens with a plain greeting, claims critical company data has been copied off the network, and sets a 72-hour window to make contact followed by a five-day window to settle, routing the victim to a Tor chat portal using supplied credentials. Its operators promote the encryptor as AI-assisted and pair a ChaCha20 stream cipher with NTRU public-key wrapping. Victims listed on its leak portal are mostly businesses in professional services, manufacturing and technology, led by the United States and Japan. The note leans on data-protection law, warning that regulators, competitors and customers will be told of the breach if no deal is reached, so stolen data should be presumed in the attackers' hands.

File extensions: .ailock

Ransom note filenames: ReadMe.txt

Decryptor: No public decryptor was found. Checked 2026-10-14.