PILLAR 1: EXTORTION NLP INTELLIGENCEDARKNET ONION & WALLET CORRELATOR

Ransom Note NLP Intelligence & Wallet Extractor

Select Note Sample:

Extortion Demand

$1.80M

28.5 BTC

Identified Wallets

1 Addresses

Tracked on Darknet Ledger

Tor Onion Mirrors

1 Portals

v3 Onion Gateway Verified

Similarity Match

98.4%

LockBit Supporter Gang #31 (Affiliate Lead)

Raw Ransom Note: Restore-My-Files.txt

>>> LockBit 3.0 (Black) Ransomware Notice <<<
Your hospital files are encrypted and 1.8 TB of patient confidential records have been downloaded to our darknet servers.
If you do not pay $1,800,000 in Bitcoin within 72 hours, all patient medical histories and SSNs will be published to the public leak blog.
To decrypt your files, download Tor Browser and navigate to:
http://lockbitaptc2xnk7b5yvh7y5vxsq.onion/chat/8841
BTC Address: bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

NLP Psycholinguistic & Sentiment Assessment:

Extortion Model:

Double Extortion (Leak + Encrypt)

Urgency / Coercion:

HIGH (72h Expiration)

Threat Tone:

Professionalized Corporate Extortion

EXTRACTED THREAT ENTITIES & TARGETS

Bitcoin / Monero Wallets:

bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh

Darknet Onion Portals:

http://lockbitaptc2xnk7b5yvh7y5vxsq.onion/chat/8841

Contact Emails:

lockbithelp@onionmail.org

CROSS-CASE NLP SIMILARITY MATRIX

LockBit 3.0 Affiliate Gang #31

Healthcare · Observed 2026-07-14

98.4%

LockBit Supporter Group #18

Biotech · Observed 2026-06-29

94.2%

BlackCat / ALPHV Base Template

Finance · Observed 2026-08-01

62.1%

Royal Ransomware v2

Defense · Observed 2026-05-19

48.7%