ailock
ransomware group · aka Ailock, AI Lock (alternate styling) · unknown (victim base skews heavily toward Japan; operator nationality/infrastructure not established in public reporting) · active since Exact emergence date unknown; publicly documented by security press since at least mid-2025 (including the Ferrovial claim); dashboard tracking of its leak site began 2026-06-15
Victims · 7d
0flat
Victims · 30d
2active targets
Victims · 90d
12
All-time (tracked)
51since 2026-03-03
Last post
08-26 12:28UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Ailock is a ransomware and data-extortion group that operates a public leak site naming victims, with 13 total victims posted since the dashboard began tracking it in June 2026. Its victim base skews heavily toward Japan-based organizations, with additional claimed victims in Spain, Canada, and the United States. The group uses a double-extortion model, publishing stolen data to pressure victims into negotiating. Public technical reporting on Ailock — initial access vectors, tooling, and affiliate relationships — remains limited. Ferrovial's confirmed June 2025 cyber incident is the group's most publicly corroborated attack to date.
Tactics & tooling
- Double extortion: data theft paired with ransomware encryption and threatened publication (per security press reporting)
- Operates a dedicated leak/extortion blog to name-and-shame victims and set publication deadlines
- Victimology shows disproportionate targeting of Japan-based organizations across multiple industries (leak-site listings)
- Targets mid-sized and large enterprises; listed victims span transportation, construction/infrastructure, real estate, education, and business/IT services
- Initial access vectors, malware families, and affiliate ties: not documented in detail in public reporting as of 2026 (unknown)
Targeted sectors
transportation and logisticsconstruction and infrastructurereal estatebusiness and IT serviceseducationmanufacturing/industrial services
Notable public victims
Ferrovial (Spain-based multinational infrastructure operator; company confirmed a cybersecurity incident in June 2025, per company statements reported by media; listed on Ailock's leak site), Nihon Kotsu Co., Ltd. (major Japan-based taxi/transport operator; listed on leak site), Richmont Graduate University (Toronto-based graduate school; listed on leak site), Morgan Services (listed on leak site), Pinturas Prisa (listed on leak site)
Estimated earnings
No public figure.
Leak-site victims51 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Morgan Services | · 20d ago | — |
| Hamilton | · 20d ago | — |
| DAISEN | · Aug 13, 2026 | — |
| Yaomasa | · Aug 13, 2026 | — |
| Nihon Kotsu Co., Ltd. | · Jul 15, 2026 | — |
| Solid Advance Inc. | · Jul 15, 2026 | — |
| Ferrovial | · Jul 15, 2026 | — |
| WBF Construction | · Jul 14, 2026 | — |
| Pinturas Prisa | · Jul 9, 2026 | — |
| Studio Sardano | · Jul 7, 2026 | — |
| Richmont Graduate University | · Jul 7, 2026 | — |
| Hokua | · Jun 26, 2026 | — |
| Röben Tonbaustoffe GmbH | · Jun 15, 2026 | — |
| Groupe Sécurité CLB | · Jun 4, 2026 | — |
| Schneebeli | · Jun 1, 2026 | — |
| Restorative Therapies, Inc. | · May 29, 2026 | — |
| Artso International, Inc. | · May 24, 2026 | — |
| Design Engineering & Consulting | · May 18, 2026 | — |
| Jazz Hipster | · May 18, 2026 | — |
| Accretech America Inc. | · May 11, 2026 | — |
| Site Design Group | · May 2, 2026 | — |
| Raich Sp. z o.o. | · Apr 27, 2026 | — |
| Mother's Market & Kitchen | · Apr 23, 2026 | — |
| PremCom | · Apr 22, 2026 | — |
| Alvi Associates | · Apr 10, 2026 | — |
| Berning & Söhne GmbH | · Apr 3, 2026 | — |
| Piet Vijverberg | · Apr 3, 2026 | — |
| Solutions Extreme Technology | · Mar 17, 2026 | — |
| England Hockey | · Mar 12, 2026 | — |
| Johnson Vollmerhausen & Gates | · Mar 9, 2026 | — |
| Netwerk NV | · Mar 9, 2026 | — |
| Eeyou Communications Network | · Mar 9, 2026 | — |
| Transsion | · Mar 9, 2026 | — |
| Demanor | · Mar 3, 2026 | Date: Coming soon Demanor AS specializes in providing customized goods lifts and lifting machines tailored to the specific needs and conditions of their clients. |
| Aaronson Rappaport Feinstein & Deutsch | · Mar 3, 2026 | Date: Coming soon Aaronson Rappaport Feinstein and Deutsch, LLP is a New York-based law firm that specializes in providing legal services across various practice areas, including medical malpractice, construction litigation, and product liability. |
| Dallas Regional Chamber | · Mar 3, 2026 | Date: 2026-01-24 The Dallas Regional Chamber is a prominent business organization known for its role as the economic growth champion and business voice of the Dallas region. It focuses on priorities such as economic development, education, public policy, and quality of life. |
| ShopBot Tools | · Mar 3, 2026 | Date: 2026-01-16 ShopBot Tools is a leading manufacturer of high-quality CNC routers, designed for machining various materials including wood, plastic, and aluminum. |
| Navicore Solutions | · Mar 3, 2026 | Date: 2026-01-11 Navicore Solutions strengthens the well-being of individuals and families through education, guidance, advocacy and support. |
| Professional Retail Outlet Services | · Mar 3, 2026 | Date: 2026-01-09 PROS specializes in facilities management and maintenance services for specialty retail chains, boasting 20 years of experience. |
| S&R Compression, LLC | · Mar 3, 2026 | Date: 2026-01-10 S&R Compression is an oil & energy company offering compression and vapor recovery services. |
| Emanuelson-Podas | · Mar 3, 2026 | Date: 2026-01-10 Emanuelson-Podas, Inc. is a mechanical, electrical, and plumbing engineering firm that specializes in creating innovative building system solutions. |
| ELO Digital Office | · Mar 3, 2026 | Date: Coming soon ELO Digital Office, founded in 1996 and headquartered in Stuggart, Germany, is a provider of enterprise content management systems and develops software solutions to digitize business processes. |
| Promotion Management Center | · Mar 3, 2026 | Date: 2025-10-14 Founded in 1983, Promotion Management Center, Inc. (PMC) provides fulfillment services. The company specializes in customer incentives, loyalty rewards, employee recognition awards, rebates and third party logistics (3PL) orders your programs generate. |
| Sterling Industries | · Mar 3, 2026 | Date: 2025-10-11 Sterling Industries is a North American-based contract manufacturer and assembler of medical devices and sub-components. |
| Raw Seafoods | · Mar 3, 2026 | Date: 2025-07-24 Raw Seafoods, Inc. is a family owned and operated company in Fall River, Massachusetts dedicated to providing our customers with exceptional products, and service. We specialize in fresh and frozen scallops, fish and value-added food solutions. |
| FUJIFILM Speciality Ink Systems | · Mar 3, 2026 | Date: 2025-07-21 FUJIFILM Speciality Ink Systems Ltd is a company that operates in the Chemicals & Related Products industry. The company is headquartered in Saint Peters, Kent, United Kingdom. |
| Lewis Drug | · Mar 3, 2026 | Date: 2025-07-06 Founded in 1942, Lewis Drug owns and operates a chain of drug and pharmacy stores. It provides prescription and non-prescription drugs. |
| HomeSite Services | · Mar 3, 2026 | HomeSite Services Inc., a residential, commercial and retail services company, was founded in 2005 with three goals in mind: to perform superior work, offer quality products, and provide our clients with unbeatable service. |
| Revival Animal Health | · Mar 3, 2026 | Revival Animal Health was founded in 1989 by Dr. Roy Nielsen, Jr., affectionately known as "Doc Roy." Quickly the company expanded from pet vaccines to an extensive line of pet healthcare products. |
| AJ Networks | · Mar 3, 2026 | AJ Networks Co. Ltd is a company that operates in the Other Rental Stores (Furniture, A/V, Construction & Industrial Equipment) industry. It employs 500to999 people and has 500Mto1G of revenue. The company is headquartered in Seoul, South Korea. |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .