Adminlocker ransomware group
Adminlocker is one of the extortion operations we watch continuously. This page covers what is known about the group and the current state of its leak site, which we last saw change 2y ago.
Who they are
AdminLocker was first observed around December 2021 and appears to be a lone operator or small group, with no clear Ransomware-as-a-Service (RaaS) model reported. It uses single-extortion tactics—encrypting files without publicly documented data exfiltration—primarily targeting enterprise and personal systems via methods such as malicious email attachments, cracked software installers, P2P downloads, and malvertising. The ransomware employs symmetric and asymmetric encryption (likely AES combined with RSA) to lock files, appending extensions such as .admin1, .admin2, .admin3, .1admin, .2admin, and .3admin; victims receive a “!!!Recovery File.txt” ransom note with instructions to pay via Tor and Bitcoin. Notable for its multiple simultaneous variants with varied extensions, it reportedly allows victims to decrypt up to five small files as “proof” before demanding ransom. No high-profile sector- or region-specific campaigns are publicly documented.
Current status
Adminlocker's leak site is not answering. Sites go dark for infrastructure trouble, a deliberate quiet period, or a takedown, and a good number return weeks later under the same name, so the entry stays on the list either way.
The last change we recorded on it was 2y ago (16 Jul 2024 18:01 UTC).
Which organisations this group has named, and when, is part of the SINON platform rather than this page. Create an account to search it, or to be told automatically if a name you care about turns up.
Sectors targeted
This group does not state an industry on its site, so we have nothing reliable to report. Most crews are opportunistic rather than sector-specific in any case — they hit what they can reach.
Watching for your name
If Adminlocker posts your company, a supplier or a subsidiary, you want to hear it from us rather than from a journalist. SINON checks these sites continuously and alerts on the names you give it.
Start monitoring