Identification of a new cybercriminal group: Lockean

**Executive summary:** The ANSSI report attributes a set of 2020–2021 intrusions against French organizations to a single criminal group named Lockean, which leverages phishing (Emotet/TA551), QakBot/IcedID loaders, Cobalt Strike (Akamai/Azure-typosquatted C2 cluster), and Rclone-based exfiltration (svchost naming) before deploying multiple RaaS families (Egregor, DoppelPaymer, Sodinokibi, ProLock); the document includes infrastructure pivots, IoCs, MITRE ATT&CK mappings and recommended investigative linkages.