LunaLock Ransomware Targets Artists, Steals and Encrypts Data

Independent illustrators and digital art clients have found themselves in the crosshairs of a newly emerged ransomware strain known as LunaLock, which claims responsibility for infiltrating Artists & Clients, a popular marketplace for commissioned artwork.

LunaLock operators announced on September 8, 2025, that they successfully breached Artists & Clients’ infrastructure, exfiltrated sensitive files, and encrypted critical databases, demanding a substantial ransom in cryptocurrency.

Attack Vector and Exploitation Technique

Preliminary forensic analysis indicates the adversaries exploited a zero-day vulnerability in the web application’s authentication module.

By exploiting a SQL injection vulnerability in the login endpoint, attackers were able to bypass multi-factor authentication and gain administrative privileges. Once inside, they deployed a multi-stage payload:

1. A custom loader written in Go that established persistence via scheduled tasks and disabled Windows Defender real-time monitoring through registry tampering (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableRealtimeMonitoring=1).
2. A modular exfiltration tool that scanned network shares for files with extensions typical of high-resolution artwork (.psd, .ai, .png) and customer personal data, packaging them into encrypted archives via AES-256-GCM.
3. The LunaLock ransomware binary, which encrypts target files with asymmetric RSA-4096 for key wrapping and appends the extension .luna to each encrypted file.

Network traffic captures reveal that exfiltrated archives were transmitted to a remote C2 server hosted on an anonymized IPv6 address, using HTTPS over non-standard port 8443 with self-signed TLS certificates to evade detection.

The attackers also disabled Windows Event Logging by altering service startup types, hampering real-time incident response.

Data Impact and Response Measures

Victims report that both client project files and personal information, including contact details and payment records, have been compromised.

The LunaLock group has threatened to publish stolen data on public leak sites if payment demands are not met within seventy-two hours.

Artists & Clients’ security team has taken the affected servers offline, initiated password resets for all user accounts, and engaged an external incident response firm specializing in ransomware recovery.

They are deploying endpoint detection and response (EDR) agents with behavioral analytics to detect lateral movement and anomalous file encryption behavior.

Additionally, an urgent patch is being rolled out to remediate the SQL injection vulnerability, and a comprehensive audit of all web-facing applications is underway.

Independent cybersecurity experts recommend organizations in the creative industry adopt the following hardening strategies: implement least-privilege access controls, enforce strict input validation for web forms, maintain offline backups with immutable storage, and deploy network segmentation to isolate critical assets.

As LunaLock’s ransom timer ticks down, artists and clients face mounting pressure to restore services without capitulating to cybercriminal demands.

The incident underscores the evolving threat landscape targeting niche online marketplaces, highlighting the critical need for proactive security measures in the digital art ecosystem.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates