Behranlift.com listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Iran
• Sector: Manufacturing
• Announcement date: December 26, 2025

Lockbit5 claims attack on behranlift.com

The Lockbit5 ransomware group has announced the listing of behranlift.com on its dedicated leak platform. According to the claims made by the threat actor group, the institution was subjected to a cyberattack on April 12, 2025. The group alleges that they have successfully obtained data belonging to the organization and has issued threats to publish the stolen information publicly.

The announcement regarding this incident was made on the group's leak site on December 26, 2025. While the group has officially listed the organization, it is important to note that this remains a claim made by the ransomware group. The presence of an organization on a leak site typically indicates that a threat actor group is attempting to pressure the victim through the threat of public exposure.

Details regarding the alleged data breach

At this stage of the incident, no specific details regarding the nature or the scope of the allegedly leaked data have been shared by the attackers. The information provided by the group is limited to a general redirection page used by the Lockbit5 group, which does not offer specifics on the contents of the breach.

The listing names no specific data types that have been compromised.

About behranlift.com

Behran Industrial Group is an Iran-based industrial company specializing in the manufacturing and design of elevator and escalator components. The company's production portfolio includes elevator motors, control panels, and various mechanical parts required for vertical transportation systems.

Impact and security considerations

This incident may have negative impacts on the institution's operational continuity and commercial reputation. Depending on the content of the leaked data, confidential information regarding the institution's intellectual property and manufacturing processes could be exposed. Given the past activities of the Lockbit group, there is a possibility that they may demand a ransom through double extortion and release the data publicly.

Double extortion is a common tactic used by ransomware groups where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release private data on a public leak site, attackers aim to increase the pressure on the victim to pay a ransom to prevent reputational damage or regulatory consequences.

In such scenarios, organizations are often advised to review their data security protocols and take necessary precautions against potential data breaches. This includes implementing robust backup solutions, maintaining strict access controls, and ensuring that all software and systems are regularly patched. Monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are also critical defensive steps for organizations in the manufacturing sector to mitigate the risks posed by sophisticated ransomware groups.

Publicly available information regarding the specific operations and methodologies of the Lockbit group remains limited.