Threat Actors Reportedly Marketing Monolock Ransomware on Dark Web Forums

October 21 2025 saw a surge of activity on dark web forums around Monolock Ransomware V1.0, with threat actors claiming a fully functional toolkit is for sale, including encryption modules, key exchange, and a custom-built administrative panel.

According to the advertisement, Monolock supports multi-threaded AES-256 encryption across Windows and Linux, with a command-and-control framework written in GoLang, and claims that victims’ files are encrypted in seconds aided by an inline public key block for secure exchanges. Samples shared by the vendor show a minimalist UI, real-time encryption logs, and a kill-switch that halts anti-virus processes before deployment, with prices ranging from 2.5 to 10 Bitcoin depending on access levels.

Threat intelligence firm CypherWatch estimates that even the entry price represents thousands of dollars at current Bitcoin values, signalling confidence in the tool’s profitability. The article notes potential risks to organisations from Monolock’s evasion tactics, its automatic torrent-based distribution, and exfiltration across cloud storage services, while urging improved incident response, offline backups, and regular threat-hunting to mitigate threats.