GENERAL__2021__CERTFR-2021-CTI-009.pdf

The ANSSI report identifies the Lockean cyber criminal group and traces its operations across 2020–2021, linking QakBot loaders, Cobalt Strike infrastructure spoofing Akamai/Azure domains, Rclone exfiltration, and several ransomware families (Maze, Egregor, ProLock, DoppelPaymer, Sodinokibi) to a set of French incident victims, describing phishing-based initial access, lateral movement, data exfiltration, and encryption as part of a double-extortion campaign.