LunaLock Ransomware Attacking Artists to Steal and Encrypt Data

LunaLock is a newly surfaced ransomware strain attacking independent artists and their clients, demanding a hefty ransom in exchange for stolen artwork and leaked personal data. Emerging in early September 2025, the LunaLock group claims responsibility for breaching Artists & Clients, a digital marketplace where illustrators connect with patrons.

Reports indicate that LunaLock operators exploited a critical vulnerability in the platform’s remote desktop service, causing connection timeouts and host errors late on 6 September 2025. A ransom notice appeared on the site’s login page, with a countdown clock showing 4 days, 8 hours, 11 minutes and 6 seconds remaining. The attackers warned that unpaid ransoms would see all artwork handed to AI training datasets sold to technology companies.

According to VenariX, security researchers analysing LunaLock’s code advise affected organisations to isolate infected servers, preserve logs, and consult incident response firms rather than negotiating through unverified channels. The incident highlights a shift towards targeting niche creative communities, where high-value intellectual property and client details are at stake.