LV ransomware
Attribution profile
- Type
- Criminal
- Location
- United States of America
- Known incidents
- 5 incidents
- Sources
- 0 sources
- First seen
- 2020-06-18
- Last seen
- 2022-08-01
- Updated
- 2026-10-13 20:19
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The LV ransomware group, also known as LV ransomware, is a threat actor traced to the United States. It has been linked to ransomware incidents affecting a semiconductor manufacturer, a regional transit authority, educational institutions, and a grey‑marketplace for Roblox in‑game items. The group’s activity shows a financially motivated extortion model: victims receive ransom demands (e.g., $1 million for the Moses Lake School District) and, in some cases, threats of data leakage after exfiltrating up to two terabytes of information. Initial access has been observed via phishing emails, and the malware encrypts files while stealing data before encryption (double‑extortion). Targets have been located in the United States and the United Kingdom, spanning manufacturing, public transportation, education, and online gaming sectors. No public reporting ties the group to a state sponsor or a larger criminal consortium. Representative operations include the 2022 Semikron attack, the 2022 Cape Cod Regional Transit Authority incident, the 2021 City Lit college breach, the 2020 Moses Lake School District ransomware event, and the 2020 compromise of a Roblox grey‑marketplace that harvested user credentials and transaction data.
Incidents
Attributed incidents are available to members.
5 incidentsSources
Sources available to members: 0 sources.