lorenz

Lorenz is a ransomware group active since early 2021, known for an unusual tactic of selling access to victim networks to other threat actors if victims refuse to pay, in addition to publishing stolen data. The group has been observed exploiting Mitel VoIP device vulnerabilities for initial access. Lorenz targets mid-size organizations across multiple sectors and its origins and affiliations have not been definitively attributed by researchers.