Lorenz ransomware

Lorenz is a ransomware operation that breaks into company networks, takes data and then encrypts it. Attacks date back to February 2021 or earlier, and its earliest builds, tracked as SZ40, added only .sz40. Later encrypted files end in .Lorenz.sz40 and the originals are deleted. The note was first left as HELP_SECURITY_EVENT.html, and newer samples switched to a plain-text note. Known ways in include phishing sent from a hijacked supplier mailbox and a flaw in Mitel MiVoice Connect phone appliances (CVE-2022-29499), followed in one case by tunnelling tools, BitLocker on Windows drives and encryption of ESXi hosts. Stolen data is first offered for sale, then posted on the group's leak site as password-protected RAR archives whose password goes public if nobody pays, and the group also sells access to the breached network. Tesorion's free Lorenz Decryptor, listed on No More Ransom, restores some undamaged files of supported types such as Word, Excel and PowerPoint files, PDFs and some picture and video formats. An encryptor bug cuts the last 48 bytes from any file whose size divides evenly by 48, and nobody can bring those bytes back. Isolate affected hosts, keep encrypted samples and run the decryptor on copies first.

Sources: Arctic Wolf, Cybereason, Tesorion, No More Ransom, The Record

File extensions: .Lorenz.sz40

Ransom note filenames: HELP_SECURITY_EVENT.html

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-30.

Scope: Tesorion's Lorenz Decryptor, free through No More Ransom, only handles non-corrupted files of supported types: Office documents, PDFs and some picture and video formats. Other file types stay locked. Any file whose size is an exact multiple of 48 bytes permanently loses its final 48 bytes to an encryptor bug that no key can undo.

Data exfiltration risk: Likely — The ransom note states company data was downloaded before encryption and the group operates a data-leak site; no independent forensic confirmation was among the fetched sources.

Systems typically targeted: Corporate Windows networks

Do this first: Keep HELP_SECURITY_EVENT.html and a few encrypted Office or PDF files, then try the free Lorenz Decryptor from Tesorion before changing anything.

From the ransom note HELP_SECURITY_EVENT.html:

Lorenz. Welcome. Again. ===--- [+] Whats Happen? [+] Your files are downloaded, encrypted, and currently unavailable. You can check it. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you can't return your data (NEVER). [+] What guarantees? [+] […]

Sources: Tesorion