France’s Computer Emergency Response Team (CERT-FR) published a report this week after identifying Lockean as the group responsible for numerous cyberattacks against French companies since 2020. CERT-FR stated, in their report linked below, that Lockean is a ransomware “affiliate group” as the ransomware utilized in their cyberattacks operate under the ransomware-as-a-service (Raas) business model. Also, the group has been active since June of 2020 and has compromised approximately eight (8) French companies. Lockean has been seen utilizing the “Egregor”, “ProLock”, “Maze”, “DoppelPaymer”, and REvil (“Sodinokibi”) ransomware strains and was identified to “typically rent access to corporate networks that had been previously infected via Emotet phishing emails” in which “they would deploy the QakBot malware and later the CobaltStrike post-exploration framework”. CERT-FR explained that Adfind, Bloodhound, BITSadmin, and Cobalt Strike were the common tools Lockean utilized to move laterally in their attacks and that Rclone was used before encrypting in order to exfiltrate the victims’ data. Any data collected would then be uploaded to the leak sites associated to the ransomware strain used. CERT-FR concluded their report by emphasizing that “Lockean has a propensity to target French entities under a Big Game Hunting… rationale and therefore represents a threat to watch out for”. Indicators of compromise (IOCs) can be located at the conclusion of CERT-FR’s report.