What is a ransom note in cybersecurity?

A ransom note is a message left by attackers after a successful ransomware attack. It informs the victim that their files have been encrypted and, in most modern attacks, that data has been exfiltrated. The note provides instructions for paying the ransom in exchange for a decryption key and a promise not to publish stolen data. Modern ransom notes include unique victim IDs, Tor-based negotiation portals, deadline timers, and increasingly, specific references to regulatory obligations or named individuals whose data has been taken.

What should I do if I receive a ransom note?

Contact Group-IB’s incident response experts immediately. There is a chance that your files can be decrypted and that your data can be recovered. Do not reboot any affected systems before forensic experts can take memory dumps — this data is critical and may be lost permanently if systems are restarted. Do not engage with threat actors through any communication channel they provide. Your immediate priorities should be containment and evidence preservation. Work with incident response specialists to identify the attackers’ TTPs, determine the root cause, and uncover any hidden traces of the attackers still present in your infrastructure. Report the attack to law enforcement to initiate a formal investigation.

Should I pay the ransom?

No. Group-IB strongly advises against paying the ransom. In 83% of ransomware cases, data exfiltration is now involved, adding another layer of danger and complication. Even when organizations feel pressured to pay, there are no guarantees of recovering encrypted data or having stolen information removed from dedicated leak sites. Paying the ransom only emboldens the cybercriminals and signals that the organization is an easy target. Beyond immediate response, organizations should take proactive steps to overhaul their security strategies and stay ahead of ransomware operators.

Can ransomware be decrypted without paying?

In some cases, yes. Decryption without payment is possible when law enforcement operations have seized a ransomware group’s infrastructure and recovered decryption keys — as occurred with operations targeting LockBit and Hive. For FunkSec specifically, a free decryptor was released in July 2025 following the group’s dormancy. Group-IB’s incident response team assesses decryption possibilities as a first step in every engagement.

How do I identify which ransomware group attacked me?

Ransomware groups can often be identified through the file extension appended to encrypted files, the name and format of the ransom note file, the content and structure of the note, and the Tor address used for negotiation. Group-IB’s Threat Intelligence team maintains profiles on hundreds of active ransomware groups and can identify attackers rapidly based on these artifacts.

What is a Dedicated Leak Site (DLS)?

A Dedicated Leak Site is a website, typically hosted on the Tor network, operated by a ransomware group to publicly publish stolen data from victims who refuse to pay. Group-IB tracks over 100 active leak sites as part of its continuous threat intelligence monitoring.

What is double extortion ransomware?

Double extortion is a technique introduced by the Maze group in 2019, in which attackers both encrypt a victim’s data and exfiltrate a copy before encryption. This creates two independent threats: the operational disruption of locked files, and the reputational and legal risk of stolen data being published. Today, data exfiltration is involved in most ransomware cases. Triple extortion adds threats of DDoS attacks or direct notification to customers, partners, and regulators.

What is Ransomware-as-a-Service (RaaS)?

Ransomware-as-a-Service is a criminal business model in which ransomware developers lease their malware and supporting infrastructure to affiliates, who carry out attacks and share a percentage of ransom payments with the developers. RaaS has dramatically lowered the technical barrier to conducting ransomware attacks. In 2025, the total number of new affiliate programs dropped from 39 in 2024 to 32, an 18% decrease. While new groups continue to emerge, the net decline highlights a more cautious, fragmented market, where operators are prioritizing operational security over recruitment scale.

How can ransomware attacks be prevented?

Ransomware attacks are not instantaneous — they unfold over days, sometimes even weeks. In good news, this gives organizations several opportunities to detect and stop the attack before serious damage occurs. Implement Endpoint Detection and Response solutions like Managed XDR to identify ransomware indicators at the earliest stage Monitor dark web activity through Threat Intelligence to detect when access to your network is being bought or sold by initial access brokers Maintain regular offline data backups stored separately from primary infrastructure Conduct infrastructure audits such as Compromise Assessment and Red Teaming to identify and remediate vulnerabilities before attackers can exploit them Train your leadership with Management Masterclasses, and stress-test your teams with Tabletop Exercises to validate your readiness before a ransomware attack happens.

How does Group-IB help ransomware victims?

Group-IB’s incident response team has handled hundreds of ransomware cases across industries and geographies. From the moment you make contact, our experts work to contain the breach, preserve forensic evidence, identify the threat actor and their methods, and support recovery. In some cases, decryption without payment is possible. Our threat intelligence capabilities allow us to monitor whether your data appears on leak sites or underground forums, giving you visibility into the full scope of exposure. Group-IB is ranked #1 for Incident Response retainer by the Cybersecurity Excellence Awards.

Notes From the Most Active Ransomware Groups

Threat actor:

8Base

Targeted Region:

🇫🇷 France

🇩🇪 Germany

🇮🇹 Italy

🇯🇵 Japan

🇸🇪 Sweden

🇺🇸 United States

Targeted industry:

Manufacturing

Real estate

First seen:

03 Apr 2022

Description:

8Base is a ransomware group that encrypts data and demands a ransom for its decryption, with activities believed to have started in April 2022. On their Dedicated Leak Site (DLS), they position themselves as ethical pentesters, claiming to target companies that neglect data privacy. Group-IB specialists found that 8Base uses an obfuscated 2020 version of Phobos ransomware, with the majority of their victims being small and medium-sized businesses in the U.S., Europe, and other regions, focusing primarily on the professional, scientific, technical, and manufacturing sectors.

Ransom note:

Dear Management,
If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was leaked,
- files are encrypted
--------------------------------------------------------------------------
The best and only thing you can do is to contact us
to settle the matter before any losses occurs.

Onion Site:
http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion/contact
Telegram Channel:
https://t.me/eightbase
--------------------------------------------------------------------------
1. THE FOLLOWING IS STRICTLY FORBIDDEN

1.1 EDITING FILES ON HDD.
Renaming, copying or moving any files
could DAMAGE the cipher and
decryption will be impossible.
1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.
1.3 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher.
Sorry about that, but doing so is entirely at your own risk.

--------------------------------------------------------------------------------------------------

2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN
The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time researching and finding out the most important directories of your business, your weak points.
We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media.
2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, personal information.
- Audit reports.
- Audit SQL database
- Any financial documents (Statements, invoices, accounting, transfers etc.).
- Work files and corporate correspondence.
- Any backups.
- Confidential documents.
2.3 TO DO LIST (best practies)
- Contact us as soon as possible.
- Contact us only in our live chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
- Avoid any third-party negotiators and recovery groups. They can become the source of leaks.
--------------------------------------------------------------------------------------------------
3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 4 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.
3.2 MAKING THE WIN-WIN DEAL
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.

--------------------------------------------------------------------------------------------------
4. EVIDENCE OF THE LEAKAGE
In our contact form or mail:
http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion/contact
Write us to the mails: [email protected] or [email protected]
Write this ID in the title of your message [redacted]
--------------------------------------------------------------------------------------------------
5. HOW TO CONTACT US
5.1 Download and install TOR Browser https://torproject.org
5.2 Go to our contact form website at http://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion/contact
5.3 You can request sample files chat to review leaked data samples.
5.4 In case TOR Browser is restricted in your area use VPN services.
5.5 All leaked Data samples will be Disclosed in 7 Days if you remain silent.
5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
--------------------------------------------------------------------------------------------------
6. RESPONSIBILITY
6.1 Breaking critical points of this offer will cause:
- Deletion of your decryption keys.
- Immediate sale or complete Disclosure of your leaked data.
- Notification of government supervision agencies, your competitors and clients.
--------------------------------------------------------------------------------------------------

Get Immediate Ransomware Support

Threat actor:

Abyss

Targeted Region:

🇨🇭 Switzerland

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Manufacturing

Real estate

Science and engineering

First seen:

06 Mar 2023

Description:

Abyss is a ransomware group discovered in March 2023. Abyss ransomware encrypts the victim’s data and uploads it to a remote server for further extortion. Abyss operates a Dedicated Leak Site (DLS).

Ransom note:

We are the Abyss.

Your company Servers are crypted and your data has been stolen to our servers.

Good news for you:

1) We can restore your entire system.
2) We are not interested in publishing your information.
3) Our motivation is purely financial.
4) We are open to negotiations.
5) We are ready to maintain complete confidentiality of this incident.

Let's explain the further steps in the situation:

You can seek help from authorities - unfortunately, this path will not lead to a constructive resolution of the situation.
They will not assist you with decryption, seize your servers for OPsec, and your company's operations will be halted.
Subsequently, the date will be disclosed, leading to fines, legal actions, and reputational damage.
OR
You initiate negotiations with us, and we reach a mutually beneficial and constructive solution for both parties.
You pay a specified amount and receive the full decryption, support throughout the decryption process,
proofs that all information on our servers has been deleted, and a guarantee that it will never resurface,
ensuring no one learns about this incident.

To initiate negotiations, please download the Tor Browser using their official website: https://www.torproject.org/
use these credentials to enter the Chat for text negotiation: http://jqlcrn2fsfvxlngdq53rqyrwtwfrulup74xyle54bsvo3l2kgpeeijid.onion/[redacted]
There will be no bad news for your company after successful negotiations for both sides. But there will be plenty of those bad news if case of failed negotiations, so don’t think about how to avoid it.
Just focus on negotiations, payment and decryption to make all of your problems solved by our specialists within 1 day after payment received: servers and data restored, everything will work good as new.

Get Immediate Ransomware Support

Threat actor:

Akira

Targeted Region:

🇧🇷 Brazil

🇨🇦 Canada

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Education

Manufacturing

Real estate

Transportation

First seen:

06 Apr 2023

Description:

Akira is a ransomware operator group discovered in April 2023. Akira ransomware encrypts the victim’s data, and once encrypted, the data is uploaded to a remote server controlled by the attackers.

Ransom note:

Hi friends,
Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.
Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:
1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank
income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.
2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.
3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.
4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.
5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.
If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:
1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.
2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.
3. Use this code - [redacted] - to log into our chat.
Keep in mind that the faster you will get in touch, the less damage we cause.

Get Immediate Ransomware Support

Threat actor:

BianLian

Targeted Region:

🇨🇦 Canada

🇮🇳 India

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Construction

Financial services

Health care

Manufacturing

Real estate

First seen:

01 Feb 2022

Description:

BianLian (also known as Masked Spider) is a ransomware gang. Infrastructure associated with the BianLian group first appeared online in December 2021, and their toolset has been under active development since then. BianLian ransomware encrypts the victim’s data using a custom encryptor developed in Go. Once the data is encrypted, it is uploaded to a remote server.

Ransom note:

Your network systems were attacked and encrypted. Contact us in order to restore your data. Don't make any changes in your file structure: touch no files, don't try to recover by yourself, that may lead to it's complete loss.

To contact us you have to download "tox" messenger: https://qtox.github.io/

Add user with the following ID to get your instructions: A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC

Alternative way: [email protected]

Your ID: [redacted]

You should know that we have been downloading data from your network for a significant time before the attack: financial, client, business, post, technical and personal files. In 10 days - it will be posted at our site http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion / http://bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion with links send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses.

---!!!---

Get Immediate Ransomware Support

Threat actor:

Black Basta

Targeted Region:

🇨🇦 Canada

🇩🇪 Germany

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Manufacturing

First seen:

14 Feb 2022

Description:

Black Basta is a ransomware group that was discovered in April 2022 and operates privately, not as a Ransomware-as-a-Service (RaaS). It encrypts victims’ data using ChaCha20 and RSA-4096 algorithms, uploading files to a remote server before completing the encryption process. Black Basta targets both Windows and Linux systems, including VMware ESXi virtual machines, using a cross-platform approach built in C++. The group uses a Dedicated Leak Site (DLS) to publish stolen data from their attacks.

Ransom note:

ATTENTION
Your network has been breached and all data was encrypted. Please contact us at:
https://bastad5huzwkepdixedg2gekg7jk22ato24zyllp6lnjx7wdtyctgvyd.onion/
Login ID: [redacted]
* To access .onion websites download and install Tor Browser at:
https://www.torproject.org/ (Tor Browser is not related to us)
* To restore all your PCs and get your network working again, follow these instructions:
- Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency.
Please follow these simple rules to avoid data corruption:
- Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption.
- Do not hire a recovery company. They can't decrypt without the key.
They also don't care about your business. They believe that they are
good negotiators, but it is not. They usually fail. So speak for yourself.
Waiting you in a chat.

Get Immediate Ransomware Support

Threat actor:

Black Byte

Targeted Region:

🇳🇱 Netherlands

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Manufacturing

Non profit

Real estate

Transportation

First seen:

11 Aug 2021

Description:

BlackByte ransomware was discovered in July 2021. This crypto-ransomware encrypts users’ data using AES and RSA encryption algorithms and then demands a ransom in Bitcoin (BTC) to recover the files. This ransomware primarily targets English-speaking users, and it can spread globally. The cybercrime group behind BlackByte also operates a Dedicated Leak Site (DLS), where stolen data is published if the ransom is not paid.

Ransom note:

All your files have been encrypted, your confidential data has been stolen,
in order to decrypt files and avoid leakage, you must follow our steps.

1) Download and install TOR Browser from this site: hxxps://torproject.org/|

2) Paste the URL in TOR Browser and you will be redirected to our chat with all information that you need.

3) If you read this message thats means your files already for sell in our Auction.
  Everyday of delaying will cause higer price. after 4 days if you wont connect us,  
  We will remove your chat access and you will lose your chance to get decrypted.

Warning! Communication with us occurs only through this link, or through our mail on our Auction.
We also strongly DO NOT recommend using third-party tools to decrypt files,  
as this will simply kill them completely without the possibility of recovery.
I repeat, in this case, no one can help you!
Your URL: http://a2dbso6dijaqsmut36r6y4nps4cwivmfog5bpzf6uojovce6f3gl36id.onion:81/[redacted]
Your Key to access the chat: [redacted]
Find our Auction here (TOR Browser): http://jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion/

Get Immediate Ransomware Support

Threat actor:

BlackSuit

Targeted Region:

🇧🇪 Belgium

🇧🇷 Brazil

🇨🇦 Canada

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Education

Manufacturing

Real estate

First seen:

01 May 2023

Description:

BlackSuit is a new ransomware variant that targets both Linux and Windows operating systems. It was first observed on May 1, 2023. This ransomware appends a .blacksuit extension to the encrypted files, indicating that the data has been compromised.

Ransom note:

Good whatever time of day it is!
Your safety service did a really poor job of protecting your files against our professionals.
Extortioner named  BlackSuit has attacked your system.
As a result all your essential files were encrypted and saved at a secure serverfor further useand publishing on the Web into the public realm.
Now we have all your files like: financial reports, intellectual property, accounting, law actionsand complaints, personal filesand so onand so forth.
We are able to solve this problem in one touch.
We (BlackSuit) are ready to give you an opportunity to get all the things back if you agree to makea deal with us.
You have a chance to get rid of all possible financial, legal, insurance and many others risks and problems for a quite small compensation.
You can have a safety review of your systems.
All your files will be decrypted, your data will be reset, your systems will stay in safe.
Contact us through TOR browser using the link:
weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd[.]onion/?id=

Get Immediate Ransomware Support

Threat actor:

Brain Cipher

Targeted Region:

🇮🇩 Indonesia

🇲🇽 Mexico

🇺🇸 United States

Targeted industry:

Government and military

First seen:

16 Jun 2024

Description:

Brain Cipher is a ransomware group discovered in June 2024. Brain Cipher ransomware encrypts the victim’s data, targeting Windows systems. The ransomware’s Windows version is a fork of the LockBit ransomware. The group communicates with victims using a negotiation page hosted on their dedicated website.

Ransom note:

Welcome to Brain Cipher Ransomware
Dear managers
If you're reading this, it means your systems have been hacked and encrypted and your data stolen.
The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours.
In order for it to be successful, you must follow a few points:
1.Don't go to the police, etc.
2[.]Do not attempt to recover data on your own.
3[.]Do not take the help of third-party data recovery companies.
In most cases, they are scammers who will pay us a ransom and take a for themselves.
If you violate any 1 of these points, we will refuse to cooperate with you
3 steps to data recovery:
1. Download and install Tor Browser (hxxps://www[.]torproject[.]org/download/)
2. Go to our support page: hxxp://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad[.]onion
3. Enter your encryption ID: [redacted]
Email to support: brain.support@cyberfear[.]com

Get Immediate Ransomware Support

Threat actor:

Cactus

Targeted Region:

🇦🇺 Australia

🇨🇦 Canada

🇫🇷 France

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Information technology

Manufacturing

Real estate

First seen:

27 Feb 2023

Description:

CACTUS is a ransomware group that has been targeting large commercial entities since March 2023. The name “CACTUS” is derived from the filename in the ransom note, cAcTuS.readme.txt, and the group’s self-declared name within the note. CACTUS operates a Dedicated Leak Site (DLS), which was first detected on July 21, 2023, containing 18 victims at the time. To become an affiliate, the group requires a deposit of 77.77777 XMR, with 20% of the ransom going to the group and the remainder to the affiliates. CACTUS ransomware targets Linux, Windows, and ESXi systems, focusing primarily on companies from developed countries.

Ransom note:

Your corporate network was compromised and encrypted by Cactus.
Do not interrupt the encryption process, don't stop or reboot your machines until the encryption
is complete. Otherwise the data may be corrupted. In addition to the encrypted infrastructure, we have downloaded a lot of confidential information from your systems. The publication of these documents may cause the termination of your commercial activities, contracts with your clients and partners, and multiple lawsuits.
If you ignore this warning and do not contact us, your sensitive data will be posted on our blog: https[:]//cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid[.]onion/
In your best interest is to avoid contacting law enforcement and data recovery companies. They can't help you with the recovery, will cause more problems and expenses, and delay the return to
normal work significantly. Besides, if you contact the police we will immediately publish your data. We offer the best solution to the problem, to receive our decryption software and prevent
disclosure of your sensitive information contact us directly. A quick recovery is very important to keep your business running at full capacity and minimize losses. This is why you need to begin negotiations as soon as possible. By the way, if you don't contact us within 5 days, we will start publishing your data.
Download TOR Browser (https[:]//www[.]torproject[.]org/download) and follow the link:
http[:]//webmail[.]cactus47hhktlaclasue3rnkchcy6rgvitxmllv2l6m25gzkgbeyfyad[.]onion
Your username:
cts0100[@]cactus47hhktlaclasue3rnkchcy6rgvitxmllv2l6m25gzkgbeyfyad[.]onion
Your password: H;^2KSgfIJg{C&)L
Reply to the welcome email and we will get your message.
Backup contact is TOX (https[:]//tox[.]chat):
7367B422CD7498D5F2AAF33F58F67A332F8520CF0279A5FBB4611E0121AE421AE1D49ACEABB2

Get Immediate Ransomware Support

Threat actor:

Ciphbit

Targeted Region:

🇧🇪 Belgium

🇫🇷 France

🇮🇹 Italy

🇳🇱 Netherlands

🇺🇸 United States

Targeted industry:

Clothing and apparel

Design

First seen:

26 Apr 2023

Description:

Ciphbit is a ransomware group that first appeared on August 31, 2023. The ransomware appends an extension to encrypted files based on a specific pattern: the original filename is followed by a unique victim ID, the threat actors’ email, and a set of random characters. The group primarily targets businesses, although affiliates are also allowed to attack home users. To become an affiliate, a $1,000 deposit is required. The group takes 30% of the revenue from the ransom, but after the first three payments, this drops to 25%.

Ransom note:

Network of your company has got CiphBit ransomware due to security weakness or system design flaw

So by this way all the files and documents have been locked in strongest encryption algorithm and also downloaded

But there is no need to worry, you can get all your files back if you do it right

What guarantee is there that you will get your files back?

You should attach a couple of unimportant encrypted files for a free decryption test
 
Contact us at the email below by subject your personal ID and attach the files

----------------
Your Personal ID: -

Your Decryption Code: -

Email Address: ciphbit@onionmail[.]org

----------------
The CiphBit TOR data leak blog links is for those who do not pay:

********

********
 
How to download and install TOR Browser in order to visit the CiphBit blog?

hxxp://www[.]torproject[.]org/download

----------------

-> WARNING <-

Do not try to rename or edit files

Do not tell anyone that your company has been attacked

Get Immediate Ransomware Support

Threat actor:

Cl0p

Targeted Region:

🇨🇦 Canada

🇩🇪 Germany

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Financial services

Information technology

Manufacturing

First seen:

01 Feb 2019

Description:

Clop is a major cybercrime group that uses Clop ransomware to encrypt victims’ sensitive files and demand ransoms in Bitcoin. Discovered in February 2019, Clop initially spread via Flawed Ammyy malware and compromised Active Directory (AD) servers by stealing administrator credentials. Over time, the group evolved its tactics, using the Get2 downloader and SDBbot backdoor for reconnaissance and lateral movement in victims’ networks. As of 2023, Clop remains one of the largest ransomware groups, with over 350 victims, and utilizes a Dedicated Leak Site (DLS) to publish stolen data since August 2021.

Ransom note:

Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN – files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
Photorec, RannohDecryptor etc. repair tools are useless and can destroy your files irreversibly.
If you want to restore your files write to emails (contacts are at the bottom of the sheet) and attach 2-3 encrypted files
(Less than 5 Mb each, non-archived and your files should not contain valuable information
(Databases, backups, large excel sheets, etc.)).
You will receive decrypted samples and our conditions how to get the decoder.
 
Attention!!!
Your warranty - decrypted samples.
Do not rename encrypted files.
Do not try to decrypt your data using third party software.
We don`t need your files and your information.
 
But after 2 weeks all your files and keys will be deleted automatically.
Contact emails:
[email protected]
or
[email protected]
 
The final price depends on how fast you write to us.
 
Clop

Get Immediate Ransomware Support

Threat actor:

d0nut

Targeted Region:

🇧🇧 Barbados

🇨🇦 Canada

🇩🇪 Germany

🇪🇸 Spain

🇺🇸 United States

Targeted industry:

Clothing and apparel

Real estate

Software

First seen:

24 May 2022

Description:

D0nut is a ransomware operator group discovered in August 2022. D0nut operates a Dedicated Leak Site (DLS). The ransom note includes a link to an onion domain, which the attackers use to communicate with victims. Additionally, the ransom note contains contact details for TOX, which the group also uses as a communication method with victims.

Ransom note:

So what happened?

All files are encrypted with Integrated Encryption Scheme.
The file structure was not damaged. You have been assigned a unique identifier.
After infection, you have 96 hours to declare decryption.

After the expiration of 96 hours, decryption cost will be automatically increased.
Now you should send us message with your personal ID, which is at the bottom of the message.
We hope that you understand the importance of the work we have done.

Before paying you can send us 2 files for free decryption.
The total size of files must be less than 2Mb.
Files should not contain valuable information (databases, backups, large excel sheets, etc..).

Attention! If you want to RECOVER YOUR DATA without problems - NEVER!!! :
reboot, disconnect hard drives or take any action unless you know WHAT YOU ARE DOING!!!
Otherwise, we cannot be 100% sure that the decryptor will work correctly.

!!!THIS IS ESPECIALLY RELATED TO ESXI!!!

If you will try to use any third party software for restoring your data or antivirus solutions:
this can lead to complete damage to all files and their irrecoverable loss.
Any changes in encrypted files may entail damage of the private key and the loss of all data.

Your personal id: [redacted]
Username and password are identical to above.

Since we are using SSL encryption as well as .onion, the certificate is not properly signed.
So in order to get into the chat, you need to confirm the insecure connection exception.
Or just use our embeded APP (Windows version only for now). Thank you for understanding.

You can download TOX here:
hxxps://tox[.]chat/download.html

You can also write to the chat located in TOR network at:
https://qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid[.]onion

You can download TOR browser here:
hxxps://www[.]torproject[.]org/download/

our TOX below:
D3404141459BC7206CC4AFEC16A3403F262C0937A732C12644E7CA97F0615201A519F7EAB2E2

We hope you carefully read this message and already know what to do.

Get Immediate Ransomware Support

Threat actor:

Daixin Team

Targeted Region:

🇨🇦 Canada

🇩🇪 Germany

🇦🇪 United Arab Emirates

🇺🇸 United States

Targeted industry:

Energy

Health care

Hospital

Manufacturing

First seen:

04 Jun 2022

Description:

The Daixin Team is a ransomware group discovered in June 2022. The Daixin Team ransomware encrypts the victim’s data, and once the data is encrypted, it is uploaded to a remote server.

Ransom note:

Welcome to the ransomware world
We have exfiltrated critial documents and information from your network.
Your systems are encrypted.
Do not try to solve this by yourself (or contact the recovery company)-
you will only lose time and money.
To contact us:
1.) Install official Tor Browser (hxxps://www[.]torproject[.]org/download/)
2.) Open hxxp://3o3xvreovoged55lgvu4xpd3zywfrh6z32uh33gvx3mwlttae6rxdvid[.]onion in Tor Browser
3.) Input your personal PIN
Your personal PIN is: [redacted]
Do not share this PIN
If you do not contact us, the data will be published within 5 days.
$$$ Daxin Team $$$

Get Immediate Ransomware Support

Threat actor:

Dark Angels

Targeted Region:

🇳🇱 Netherlands

🇺🇸 United States

Targeted industry:

Consumer electronics

Hardware

Manufacturing

Public transportation

First seen:

05 Apr 2023

Description:

Dark Angels (aka Dunghill Leak) is a ransomware operator group discovered in April 2023. Dark Angels has a DLS. Dark Angels ransomware encrypts the victim’s data. Once data is encrypted, ransomware uploads it to a remote server.

Ransom note:

--------------------------------------------------------------------------

HELLO dear REDACTED!

If you are reading this message, it means that:
- your network infrastructure has been compromised,
- critical data was leaked,
- files are encrypted,
- backups are deleted

------------------------------------------------------
| |
| by D A R K A N G E L S T E A M ! |
| |
------------------------------------------------------

The best and only thing you can do is to contact us
to settle the matter before any losses occurs.

--------------------------------------------------------------------------

1. THE FOLLOWING IS STRICTLY FORBIDDEN

1.1 EDITING FILES ON HDD.
Renaming, copying or moving any files
could DAMAGE the cipher and
decryption will be impossible.

1.2 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.

1.3 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher.
Sorry about that, but doing so is entirely at your own risk.

1.4 HIRING THE EUROPOL AND OTHERS
Cooperating with the EUROPOL, INTERPOL and so on
and involving their officers in negotiations
will end our communication with you
and we will share all the leaked data for free.

--------------------------------------------------------------------------------------------------

2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN

The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time researching and finding out the most important directories of your business, your weak points.
So, we has DOWNLOADED about 2.5TB ( ~ 2 500 GBs) of your most SENSITIVE Data just in case if you will NOT PAY, than everything will be PUBLISHED in Media, hacking forums(China, Ukraine, Russia etc) and/or SOLD to any third-party.

2.2 "WE HAS COLLECTED SUCH DATA AS:
- Project Files and Drawings(CAD files, Manuals, concept, Konstruktion_MBAU, *.vsd, *.stp, *.dwg, *.odg, *.dws, *.dwt, *.dfx, *.swg, *.ipt, *.iam, *.cdr, *.SLDDRW, *.SLDPRT, *.SLDASM, *.SKP, *.STEP, *.igs, *.iges, *.STL )
- Forschung, HW-Allgemein, Konstruktion_MBAU, Programme, Leittechnik etc
- Oracle Production DB from SRHW8226 & SRHW8239
- MSSQL Production DB from SRHW8042, SRHW8144 etc
- PII - Personal Identification Information !
- HR files, Accountant files
- Most importants files from SRHW8100(srv003) and other FileServers
- Emails and working files of top management and many employees(about 45 PST files)
- Geheimhaltungsvereinbarung(NDA), Patents, Secret and Confidential infromation
- Customer and partner files, including correspondence
and many many more.

2.3 TO DO LIST (best practies)
- Contact us as soon as possible.
- Contact us only in our live chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently.
- Avoid any third-party negotiators and recovery groups. They can become the source of leaks.

--------------------------------------------------------------------------------------------------

3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 4 days starting tomorrow your leaked data will be Disclosed or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation can be measured based on your annual budget.

3.2 MAKING THE WIN-WIN DEAL
- You will get the only working Decryption Tool and the how-to-use Manual.
- You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data.
- You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet.
- You will get our security report on how to fix your security breaches.
- You will get our Advanced Penetration Test Report about your security.
- We guarantee the removal of all backdoors in your network

--------------------------------------------------------------------------------------------------

4. EVIDENCE OF THE LEAKAGE

REDACTED

--------------------------------------------------------------------------------------------------

5. HOW TO CONTACT US

5.1 Download and install TOR Browser https://torproject.org
5.2 Go to our live-chat website at hxxps://wemo2ysyeq6km2nqhcrz63dkdhez3j25yw2nvn7xba2z4h7v7gyrfgid[.]onion/page/REDACTED
5.3 You can request additional Proof Pack with your data in our live chat to review.
5.4 In case TOR Browser is restricted in your area use VPN services.
5.5 All leaked Data will be Disclosed in 4 Days if you remain silent.
5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed.
5.7 Your Data will immediately Disclosed if you will hire third-party negotiators to contact us.

--------------------------------------------------------------------------------------------------

6. RESPONSIBILITY

6.1 Breaking critical points of this offer will cause:
- Deletion of your decryption keys.
- Immediate sale or complete Disclosure of your leaked data.
- Notification of government supervision agencies, your competitors and clients.
--------------------------------------------------------------------------------------------------

Get Immediate Ransomware Support

Threat actor:

Devman

Targeted Region:

🇫🇷 France

🇹🇼 Taiwan

Targeted industry:

Health care

Legal

Manufacturing

First seen:

April 2025

Description:

Devman is a former Qilin affiliate who launched independent ransomware operations in 2025, with victims appearing on both DLS platforms simultaneously suggesting a parallel overlap before full separation. One confirmed victim also appeared on Lynx’s DLS, indicating shared or brokered initial access across groups. The actor is notable for aggressive public branding via X (@Inifintyink), where he taunts victims by name, confirms intrusion details, and publicly announces ransom demands — including one post naming a victim, specifying an $800,000 demand, a 10-day deadline, and the exact vulnerability exploited.

Ransom note:

!! IMPORTANT !!!

██████╗ ███████╗██╗ ██╗███╗ ███╗ █████╗ ███╗ ██╗ ██████╗ ██╗
██╔══██╗██╔════╝██║ ██║████╗ ████║██╔══██╗████╗ ██║ ╚════██╗ ███║
██║ ██║█████╗ ██║ ██║██╔████╔██║███████║██╔██╗ ██║ █████╔╝ ╚██║
██║ ██║██╔══╝ ╚██╗ ██╔╝██║╚██╔╝██║██╔══██║██║╚██╗██║ ██╔═══╝ ██║
██████╔╝███████╗ ╚████╔╝ ██║ ╚═╝ ██║██║ ██║██║ ╚████║ ███████╗██╗██║
╚═════╝ ╚══════╝ ╚═══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═══╝ ╚══════╝╚═╝╚═╝

All of your files have been encrypted with a unbreakable encryption algorithm.
However, this is not the only bad news for you. Some of your files have been exfiltrated
from your company and will be published on our website if you do not cooperate with us.

The only way to decrypt your files is to get the decryption tool and unique key.

To obtain the decryption tool, you need to:
1. Contact us at: tygjm32hxyqienrgwxveiaw3azbjmfaln2znn2hldz2oe6v453ngwlyd.onion/[SNIP]
2. Send your unique ID: [SNIP]
3. Receive a sample decryption of up to 4 files, and the file listing of exfiltrated data
4. We will provide payment instructions
5. After payment, you will receive decryption tool

WARNING:
- Do not modify encrypted files
- Do not use third party software to restore files
- Do not reinstall system

If you violate these rules, your files may be permanently damaged.

Files encrypted: [SNIP]
Total size: [SNIP] bytes
Unique ID: [SNIP]

Backup contact (Qtox) 9D97F166730F865F793E2EA07B173C742A6302879DE1B0BBB03817A5A04B572FBD82F984981D

Get Immediate Ransomware Support

Threat actor:

Dire Wolf

Targeted Region:

🇦🇺 Australia

🇧🇷 Brazil

🇲🇾 Malaysia

Thailand

Turkey

🇺🇸 United States

Targeted industry:

Financial services

Health care

Manufacturing

Real estate

Transportation

First seen:

May 2025

Description:

Dire Wolf is a ransomware operator discovered in May 2025 that has rapidly become one of the most prolific threats in the current landscape. The group operates a double extortion model, encrypting victims’ files with the .direwolf extension while exfiltrating sensitive data before encryption. Their DLS and negotiation portal are both hosted on the Tor network. With 171 confirmed attacks across 28+ countries in under a year, Dire Wolf has demonstrated an unusually high attack tempo, including coordinated mass campaigns targeting multiple organizations simultaneously.

Ransom note:

Dear Mr or Ms, 
If you are reading this message, it means that: 
- your network infrastructure has been compromised 
- critical data was leaked 
- files are encrypted 
-------------------------------------------------------------------------- 
The best and only thing you can do is to contact us 
to settle the matter before any losses occurs. 
-------------------------------------------------------------------------- 
We can maintain confidentiality for 3 days for you, during which we will not disclose any information about your intrusion or data leakage. 
We can extend the confidentiality period free of charge until we reach an agreement if you contact us within 3 days and communicate effectively with us.
If the confidentiality period expires, we will disclose the relevant information. 
We provide complimentary decryption testing services. For specific details, please contact us. 
-------------------------------------------------------------------------- 
We have provided a sample document as proof of our possession of your files and you can download and check it: 

- hxxps://gofile[.]io/d/3ffbuJ 

Please be advised that your files are scheduled for public release after 30 working days. 
If you want to secure your files, we urge you to reach out to us at your earliest convenience. 
-------------------------------------------------------------------------- 
Contact Details: 
- live chat room: 
- url:hxxp://direwolf3ddtab5anvhulcelauvoxu2a7l264hqs6vtxtgrqsjfvodid[.]onion/ 
- roomID: redacted 
- username: redacted 
- password: redacted 
-------------------------------------------------------------------------- 
Our official website: 
- url:http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd[.]onion/ 
-------------------------------------------------------------------------- 
How to access .onion website: 
1[.]Download and install TOR Browser https://torproject.org 
2.Open it and try to access our onion address 
3.Maybe you need to use VPN if it can not open our onion address

Get Immediate Ransomware Support

Threat actor:

DISPOSSESSOR

Targeted Region:

🇨🇦 Canada

🇴🇲 Oman

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Financial services

Information technology

Real estate

First seen:

03 May 2021

Description:

Dispossessor is a ransomware group that emerged in April 2024. The group operates its own Dedicated Leak Site (DLS). A notable feature of Dispossessor’s victims is their overlap with LockBit’s target list. The group prohibits attacks on Post-Soviet countries and critical infrastructure. Affiliates working with Dispossessor receive 80% of the ransom, while 20% goes to the group itself. To join as an affiliate, candidates are required to pay a deposit of 1 BTC.

Ransom note:

RADAR
Your network has been breached and all major data were encrypted.
Important files have been downloaded from your servers and are ready to be published on TOR blogs.
To decrypt all the data and prevent exfiltrated files to be disclosed on TOR blogs, dataleak forums, dataleak databases, telegram channels etc with lot of tags/videos on twitter/facebook you should purchase our decryption tool. We will provide you a proof video how our Decryption Tool works.
Please contact our sales department at Skype: hxxxs://join.skype.com/invite/MO0SAOWRh0zo
We appreciate and respect everyone, that's why in Skype you will get a proof, we will record a video of 5-10 files of your choice.
Follow the guidelines below to avoid losing your data:
- Do not modify, rename or delete encrypted files. In result your data will be undecryptable.
- Do not modify or rename encrypted files. You will lose them.
- Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything and your data, recorded data on videos etc will be published.
- Do not hire a recovery company. They can't decrypt files without our Decryption Tool. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. You should contact with us yourself and we'll guarantee you 10077BCB65CA365CF885446C7CB6B4ABA99uccessful decryption without any loss + exfiltrated data erasing from our servers.
- Do not reject to purchase RADAR Decryptor from us, otherwise exfiltrated files will be publicly disclosed with video of files.
P.S. Do not repeat the same mistakes as other companies did with us, for example our old case with a small Spain Company: ALVAC S.A. Their Website - hxxxs://alvac.es
Our media team published files and videos, because they didn't pay as in time. Small part of proofs:
hxxxs://vimeo.com/752214614
hxxxs://hacknotice.com/2022/10/01/alvac-sa/
hxxxs://twitter.com/elhackernet/status/1576678217603502080
hxxxs://twitter.com/search?q=alvacvimeo&src=typed_query&f=live
Lot of telegram channels like hxxxs://t.me/elconfidencial , hxxxs://t.me/baseleak , all darkweb resources list from here - hxxxs://github.com/fastfire/deepdarkCTI/blob/main/telegram.md
We have a direct contact with a list of ransomware owners in jabber and tox, you can see all the companies that refused to cooperate with us, TOR/onion URLs: hxxx://xb6q2aggycmlcrjtbjendcnnwpmmwbosqaugxsqb4nx6cmod3emy7sad.onion
hxxx://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
hxxx://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion/
hxxx://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion
hxxx://knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion/
For ALVAC SA we hired 3rd party team of data analysts with OSINT-specialists. Because of adding such 3rd parties, the price for Decryption Tool and exfiltrated data erasing has been increased. In result they suffered significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. And it will never end for them, as their files are constantly downloaded and videos are viewed by people from all over the World.
That's why we don't recommend to ignore us.

Get Immediate Ransomware Support

Threat actor:

DragonForce

Targeted Region:

🇦🇺 Australia

🇮🇹 Italy

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Manufacturing

First seen:

13 Aug 2023

Description:

DragonForce is a ransomware group discovered in September 2023. It employs a variant of the LockBit ransomware to encrypt victims’ data. The group also operates a Dedicated Leak Site (DLS) where stolen data is published if ransom demands are not met.

Ransom note:

Hello [victim]!
Your files (totobet database!) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics.
All you need to do is contact us and pay.
Our communication process:
You contact us via email or Tox.
We send you a list of files that were stolen
We decrypt 3 files to confirm that our decryptor works.
We agree on the amount, which must be paid using BTC.
We delete your files, we give you a decryptor.
We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
Recommendations:
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
Contacts:
Email: [email]
Reserve: [email]
Tox: [tox id]
* If you want to contact us via Tox you need to download it from this link:
hxxps://github[.]com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe
YOUR ID: %s
If you refuse to pay or do not get in touch with us, we start publishing your files.
After 7 days the email will no longer be available, and the opportunity to receive the decryptor will also no longer be available.
Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101

Get Immediate Ransomware Support

Threat actor:

Eldorado

Targeted Region:

🇭🇷 Croatia

🇮🇹 Italy

🇰🇷 South Korea

🇺🇸 United States

Targeted industry:

Education

Government and military

Real estate

Transportation

First seen:

03 Dec 2023

Description:

Eldorado is a ransomware group discovered in March 2024. Eldorado ransomware encrypts the victim’s data and uploads it to a remote server once encrypted.

Ransom note:

To the board of directors.
Your network has been attacked through various vulnerabilities found in your system.
We have gained full access to the entire network infrastructure.
All your confidential information about all employees and all partners and developments
has been downloaded to our servers and is located with us.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
Our team has an extensive background in legal and so called white hat hacking.
However, clients usually considered the found vulnerabilities to be minor and poorlyr\n
paid for our services.
So we decided to change our business model. Now you understand how important it isr\n
to allocate a good budget for IT security.
This is serious business for us and we really don't want to ruin your privacy,r\n
reputation and a company.
We just want to get paid for our work whist finding vulnerabilities in various networks.
Your files are currently encrypted with our tailor made state of the art algorithm.
Don't try to terminate unknown processes, don't shutdown the servers, do not unplug drives,
all this can lead to partial or complete data loss.
We have also managed to download a large amount of various, crucial data from your network.
A complete list of files and samples will be provided upon request.
We can decrypt a couple of files for free. The size of each file must be no more than 5 megabytes.
All your data will be successfully decrypted immediately after your payment.
You will also receive a detailed list of vulnerabilities used to gain access to your network.
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
If you refuse to cooperate with us, it will lead to the following consequences for your company:
1. All data downloaded from your network will be published for free or even sold
2. Your system will be re-attacked continuously, now that we know all your weak spotsr
3. We will also attack your partners and suppliers using info obtained from your network
4. It can lead to legal actions against you for data breaches
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
!!!!Instructions for contacting our team!!!!
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
---> Download and install TOR browser from this site : https://torproject.org
---> For contact us via LIVE CHAT open our website : http://panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onion/Url=redacted
---> If Tor is restricted in your area, use VPN
---> All your Data will be published in 7 Days if NO contact made
---> Your Decryption keys will be permanently destroyed in 3 Days if no contact made
---> Your Data will be published if you will hire third-party negotiators to contact us

Get Immediate Ransomware Support

Threat actor:

Embargo

Targeted Region:

🇦🇺 Australia

🇫🇷 France

🇩🇪 Germany

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Commerce and shopping

Real estate

First seen:

17 Apr 2024

Description:

Embargo is a ransomware operator group that was discovered in April 2024. The group uses its Embargo ransomware to encrypt victims’ data and demands a ransom for decryption. Embargo operates a Dedicated Leak Site (DLS) where it publishes stolen data if the ransom is not paid.

Ransom note:

Your network has been chosen for Security Audit by EMBARGO Team.
We successfully infiltrated your network, downloaded all important and sensitive documents, files, databases, and encrypted your systems.
You must contact us before the deadline 2024-07-31 05:53:57 +0000 UTC, to decrypt your systems and prevent your sensitive information from disclosure on our blog:
http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid[.]onion/
Do not modify any files or file extensions. Your data maybe lost forever.
Instructions:
1. Download torbrowser: hxxps://www[.]torproject[.]org/download/
2. Go to your registration link:
=================================
hxxp://a3kvb22nuhfgaluy6uzufrjn3azzsu7tylszdbyne3kiextdmxz4nnyd[.]onion/
[redacted]
3. Register an account then login
If you have problems with this instructions, you can contact us on TOX:
9500B1A73716BCF40745086F7184A33EA0141B7D3F852431C8FDD2E1E8FAF9277E9FDC117B47
After payment for our services, you will receive:
- decrypt app for all systems
- proof that we delete your data from our systems
- full detail pentest report
- 48 hours support from our professional team to help you recover systems and develop Disaster Recovery plan
IMPORTANT: After 2024-07-31 05:53:57 +0000 UTC deadline, your registration link will be disabled and no new registrations will be allowed.
If no account has been registered, your keys will be deleted, and your data will be automatically publish to our blog and/or sold to data brokers.
WARNING: Speak for yourself. Our team has many years experience, and we will not waste time with professional negotiators.
If we suspect you to speaking by professional negotiators, your keys will be immediate deleted and data will be published/sold.

Get Immediate Ransomware Support

Threat actor:

Everest

Targeted Region:

🇧🇷 Brazil

🇨🇦 Canada

🇫🇷 France

🇮🇹 Italy

🇵🇭 Philippines

🇺🇸 United States

Targeted industry:

Construction

Health care

Manufacturing

Real estate

First seen:

14 Jan 2020

Description:

The Everest (also known as the Everest ransom team) is a cybercrime group that uses the Everest Ransomware for its attacks. This ransomware was first detected in the wild at the end of December 2020. The Everest ransom team operates a blog for publishing stolen data. This ransomware primarily targeted companies in North America, especially in Canada. A possible name for the ransom note is: “EVEREST LOCKER.txt.”

Ransom note:

>>>>>>>>>>>>>>>>>>>>>>>>>>>> EVEREST LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<
    HELLO, DEAR FRIEND!
    1.  [ ALL YOUR FILES HAVE BEEN ENCRYPTED! ]
    Your files are NOT damaged! Your files are modified only. This modification is reversible.
    The only 1 way to decrypt your files is to receive the decryption program.
    2.  [ HOW TO RECOVERY FILES? ]
    To receive the decryption program write to email: [email protected]
    And in subject write your ID:  ID-[redacted 10 lowercase hex]
    We send you full instruction how to decrypt all your files.
    If you don't get a reply, then contact us using xmpp: [email protected]
    3.  [ FREE DECRYPTION! ]
    Free decryption as guarantee.
    We guarantee the receipt of the decryption program after payment.
    To believe, you can give us up to 3 files that we decrypt for free.
    Files should not be important to you! (databases, backups, large excel sheets, etc.)
>>>>>>>>>>>>>>>>>>>>>>>>>>>> EVEREST LOCKER <<<<<<<<<<<<<<<<<<<<<<<<<<<<

Get Immediate Ransomware Support

Threat actor:

Hunters International

Targeted Region:

🇲🇽 Mexico

🇪🇸 Spain

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Health care

Manufacturing

First seen:

20 Oct 2023

Description:

Hunters International is a ransomware group that was first detected on October 20, 2023. The group is likely connected to the Hive ransomware through purchased code. Despite this connection, on October 24, 2023, Hunters International publicly stated that they are not affiliated with Hive. This clarification came after law enforcement seized Hive’s servers in January 2023, dismantling their operations.

Ransom note:

1. WHAT HAPPENED? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

Your company's network has been compromised by the HUNTERS INTERNATIONAL group.
All files are encrypted using a military-grade AES encryption algorithm.
A large amount of sensitive data was exfiltrated.

We usually download:

- Employees personal data: CVs, DL, SSN, PII, NDA contracts, etc.
- Financial information: documents, payrolls, bank statements, bills, transfers,
  budgets, annual reports, etc.
- Customer data: contracts, PII, contacts, purchase agreements, etc.
- Confidential: source code, trade secrets, technology, blueprints, documents, 
  etc.
- Work files, databases, legal documents, corporate correspondence.
- Accounting data.
- Audit reports.



2. WHAT DO WE OFFER <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

To prevent exfiltrated data from being disclosed and to decrypt all the files 
you need to make a payment. Contact us following the instructions:

1) Install and run “Tor Browser” from https://www.torproject.org/download/

2) Go to a dedicated website:
https://hunters33mmcwww7ek7q5ndahul6nmzmrsumfs6aenicbqon6mxfiqyd.onion/
https://hunters33dootzzwybhxyh6xnmumopeoza6u4hkontdqu7awnhmix7ad.onion/ (mirror)

3) Log in using the credentials: [redacted]



3. WHAT IF NOT? <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

We have the most powerful data leak site on the Internet. There are a lot of 
journalists, researchers and other hackers.

https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/
https://huntersinternational.net/ (mirror)

An incomplete list of risks you are facing in case of non-payment:

 - Loss of customer trust and loyalty.
 - Damage to the company's reputation.
 - Legal consequences and compliance fines.
 - Financial losses and costs associated with data recovery.
 - Impact on competitive advantage and market share.
 - Breach of data privacy regulations and laws.
 - Disruption of business operations.
 - Reduced employee morale and productivity.
 - Potential for intellectual property theft.
 - Loss of trade secrets and proprietary information.



4. KEEP IN MIND <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

- Do not try to decrypt using third-party software. You will damage the files.
- Do not report to the Police, FBI, etc. They don't care about your business.
  They simply won't allow you to pay. As a result, you will lose everything.
- Do not hire a recovery company. They can't decrypt without the key.
  They also don't care about your business. They believe that they are
  good negotiators, but it is not. They usually fail. So speak for yourself.
- Do not reject to pay. Exfiltrated files will be disclosed right away.

Get Immediate Ransomware Support

Threat actor:

Inc

Targeted Region:

🇦🇺 Australia

🇨🇦 Canada

🇫🇷 France

🇩🇪 Germany

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Construction

Education

Financial services

Government

Health care

Manufacturing

Real estate

First seen:

June 2023

Description:

INC Ransom is a mature RaaS operation active since mid-2023 with one of the broadest targeting profiles in the current ransomware landscape — 192+ industry sectors across 66 countries. The group exploits Citrix NetScaler ADC and Gateway vulnerabilities as a primary initial access vector, supplemented by spear-phishing for credential harvesting. For data exfiltration, affiliates abuse the legitimate backup tool Restic, often renamed to “winupdate.exe” to evade detection, staging stolen data to cloud storage before encryption. High-profile victims include Scotland’s NHS, McLaren Health Care, Yamaha Motor, Xerox Business Solutions, and the Texas State Bar.

Ransom note:

~~~~ INC Ransom ~~~~
-----> Your data is stolen and encrypted.
If you don't pay the ransom, the data will be published on our TOR darknet sites.
The sooner you pay the ransom, the sooner your company will be safe.
Tor Browser Link:
hxxp://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/
http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid[.]onion/
Link for normal browser:
hxxp://incapt[.]su/

-----> What guarantees are that we won't fool you?
We are not a politically motivated group and we want nothing more than money.
If you pay, we will provide you with decryption software and destroy the stolen data.
After you pay the ransom, you will quickly restore your systems and make even more money.
Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you.
Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it.
If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future.
You can get more information about us on Twitter hxxps://twitter[.]com/hashtag/incransom?f=live
-----> You need to contact us on TOR darknet sites with your personal ID
Download and install Tor Browser hxxps://www[.]torproject[.]org/
Write to the chat room and wait for an answer, we'll guarantee a response from you.
Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack tens of companies around the world.
Tor Browser Link for chat:
hxxp://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid[.]onion/
Your personal ID:
[redacted]
-----> Warning! Don't delete or modify encrypted files, it will lead to problems with decryption of files!
-----> Don't go to the police or the FBI for help. They won't help you.
The police will try to prohibit you from paying the ransom in any way.
The first thing they will tell you is that there's no guarantee to decrypt your files and remove stolen files.
This is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it's a matter of our reputation.
Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees.
The police and the FBI don't care what losses you suffer as a result of our attack, and we'll help you get rid of all your problems for a modest sum of money.
If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom.
The police and FBI won't be able to stop lawsuits from your customers for leaking personal and private information.
The police and FBI won't protect you from repeated attacks.
-----> Don't go to recovery companies!
They are essentially just middlemen who will make money off you and cheat you.
We are well aware of cases where recovery companies tell you that the ransom price is $5M dollars, but in fact they secretly negotiate with us for $1M.
If you approached us directly without intermediaries you would pay several times less.
-----> For those who have cyber insurance against ransomware attacks.
Insurance companies require you to keep your insurance information secret.
In most cases, we find this information and download it.
-----> If you do not pay the ransom, we will attack your company again in the future.

Get Immediate Ransomware Support

Threat actor:

INC Ransomware

Targeted Region:

🇦🇺 Australia

🇫🇷 France

🇳🇱 Netherlands

🇵🇭 Philippines

🇺🇸 United States

Targeted industry:

Education

Non profit

Real estate

First seen:

12 Jun 2023

Description:

INC Ransomware is a ransomware group that first appeared in late August 2023. The ransomware appends the “.INC” extension to encrypted files. The group also operates a Dedicated Leak Site (DLS) to publish data stolen from victims who do not comply with their ransom demands.

Ransom note:

~~~~ INC Ransom ~~~~
-----> Your data is stolen and encrypted.
If you don't pay the ransom, the data will be published on our TOR darknet sites.
The sooner you pay the ransom, the sooner your company will be safe.
Tor Browser Link:
http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/
http://incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion/
Link for normal browser:
http://incapt.su/

-----> What guarantees are that we won't fool you?
We are not a politically motivated group and we want nothing more than money.
If you pay, we will provide you with decryption software and destroy the stolen data.
After you pay the ransom, you will quickly restore your systems and make even more money.
Treat this situation simply as a paid training for your system administrators, because it is due to your corporate network not being properly configured that we were able to attack you.
Our pentest services should be paid just like you pay the salaries of your system administrators. Get over it and pay for it.
If we don't give you a decryptor or delete your data after you pay, no one will pay us in the future.
You can get more information about us on Twitter https://twitter.com/hashtag/incransom?f=live
-----> You need to contact us on TOR darknet sites with your personal ID
Download and install Tor Browser https://www.torproject.org/
Write to the chat room and wait for an answer, we'll guarantee a response from you.
Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack tens of companies around the world.
Tor Browser Link for chat:
http://incpaykabjqc2mtdxq6c23nqh4x6m5dkps5fr6vgdkgzp5njssx6qkid.onion/
Your personal ID:
[redacted]
-----> Warning! Don't delete or modify encrypted files, it will lead to problems with decryption of files!
-----> Don't go to the police or the FBI for help. They won't help you.
The police will try to prohibit you from paying the ransom in any way.
The first thing they will tell you is that there's no guarantee to decrypt your files and remove stolen files.
This is not true, we can do a test decryption before paying and your data will be guaranteed to be removed because it's a matter of our reputation.
Paying the ransom to us is much cheaper and more profitable than paying fines and legal fees.
The police and the FBI don't care what losses you suffer as a result of our attack, and we'll help you get rid of all your problems for a modest sum of money.
If you're worried that someone will trace your bank transfers, you can easily buy cryptocurrency for cash, thus leaving no digital trail that someone from your company paid our ransom.
The police and FBI won't be able to stop lawsuits from your customers for leaking personal and private information.
The police and FBI won't protect you from repeated attacks.
-----> Don't go to recovery companies!
They are essentially just middlemen who will make money off you and cheat you.
We are well aware of cases where recovery companies tell you that the ransom price is $5M dollars, but in fact they secretly negotiate with us for $1M.
If you approached us directly without intermediaries you would pay several times less.
-----> For those who have cyber insurance against ransomware attacks.
Insurance companies require you to keep your insurance information secret.
In most cases, we find this information and download it.
-----> If you do not pay the ransom, we will attack your company again in the future.

Get Immediate Ransomware Support

Threat actor:

LockBit

Targeted Region:

🇫🇷 France

🇩🇪 Germany

🇮🇹 Italy

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Manufacturing

First seen:

18 Jan 2020

Description:

LockBit is a prominent cybercrime group known for using LockBit ransomware, first detected in December 2019. By January 2020, its attacks primarily targeted organizations in the USA, Germany, France, and China. LockBit ransomware utilizes both RSA and AES encryption algorithms and is capable of deleting backups, bypassing User Account Control (UAC), and spreading via SMB using stolen credentials. Since October 2021, LockBit has expanded its attacks to Linux systems, specifically targeting VMware ESXi virtual machines, and operates a Dedicated Leak Site (DLS) to publish stolen data.

Ransom note:

LockBit 3.0 the world's fastest and most stable ransomware from 2019 
 >>>>> Your data is stolen and encrypted.
  BLOG Tor Browser Links:  
 http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/  
 http://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id.onion/
  http://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid.onion/
  http://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid.onion/ 
 http://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad.onion/
  http://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad.onion/
  http://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion/
  >>>>> What guarantee is there that we won't cheat you  
 We  
are the oldest ransomware affiliate program on the planet, nothing is 
 more important than our reputation. We are not a politically motivated
group and we want nothing more than money. If you pay, we will fulfill  
all the terms we agree on during the negotiation process. Treat this 
 situation simply as a paid training session for your system  
administrators, because it was the misconfiguration of your corporate  
network that allowed us to attack you. Our pentesting services should be  
 paid for the same way you pay your system administrators salaries. You  
can get more information about us on Ilon Musk's Twitter  
https://twitter.com/hashtag/lockbit 
 f=live 
 >>>>> You need to contact us on TOR darknet sites with your personal ID 
 Download and install Tor Browser https://www.torproject.org/ 
 Write  
 to the chat room and wait for an answer, we'll guarantee a response
from us. If you need a unique ID for correspondence with us that no one 
 will know about, ask it in the chat, we will generate a secret chat for  
you and give you his ID via private one-time memos service, no one can 
 find out this ID but you. Sometimes you will have to wait some time for  
our reply, this is because we have a lot of work and we attack hundreds  
of companies around the world.
  Tor Browser personal link for CHAT available only to you (available during a ddos attack): 
 http://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad.onion 
 Tor Browser Links for CHAT (sometimes unavailable due to ddos attacks):
  http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onion 
 http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onion 
 http://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid.onion 
 http://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd.onion 
 http://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd.onion 
 http://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd.onion 
 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
  >> Your personal Black ID: EF689D235EF31C4A496987A98A922E72 << 
 >>>>> Warning
  Do not delete or modify encrypted files, it will lead to problems with decryption of files
  >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you.

Get Immediate Ransomware Support

Threat actor:

Lynx

Targeted Region:

🇩🇪 Germany

🇮🇳 India

🇺🇸 United States

Targeted industry:

Financial services

Health care

Legal

Manufacturing

First seen:

July 2024

Description:

Lynx is a RaaS operation that emerged in July 2024 using a fork of INC Ransom source code — the two share 48% code similarity, suggesting a common developer lineage or deliberate rebrand. The group runs a structured affiliate program offering an 80/20 revenue split favoring affiliates, recruited openly on RAMP by the user “silencer.” Infrastructure is unusually redundant for a group of its age, with 29 Tor domains spanning admin panels, blog mirrors, guest panels, and internal chat systems. The ransomware targets Windows, ESXi, and NAS systems, with configurable encryption modes ranging from 5% to 100% of file content, allowing affiliates to balance speed and impact. Dedicated call centers are available to affiliates for victim harassment during negotiations. The group explicitly excludes CIS countries, Ukraine, China, Iran, and North Korea from targeting, and maintains a self-imposed restriction against attacking healthcare, government, churches, non-profits, and child welfare organizations — though March 2026 incidents indicate healthcare targeting has occurred in practice.

Ransom note:

Your data is stolen and encrypted.
Your unique identificator is [REDACTED]

Use this TOR site to contact with us:
hxxp://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd[.]onion/login

Use this email to contact with us:
martina.lestariid1898@proton[.]me

Our blog
TOR Network:
hxxp://lynxbllrfr5262yvbgtqoyq76s7mpztcqkv6tjjxgpilpma7nyoeohyd[.]onion/disclosures

Mirror 1: hxxp://lynxblog[.]net/

Get Immediate Ransomware Support

Threat actor:

mallox

Targeted Region:

🇧🇷 Brazil

🇫🇷 France

🇮🇳 India

🇵🇹 Portugal

🇺🇸 United States

Targeted industry:

Manufacturing

Software

First seen:

12 Jun 2021

Description:

Mallox is a long-standing ransomware group. It was first observed in June 2021 under the name “TargetCompany ransomware” but was later renamed “Fargo” in mid to late 2022 due to the extension it adds to encrypted files. From December 2022 onwards, it became known as Mallox. Mallox perates a Dedicated Leak Site (DLS).

Ransom note:

Your files are encrypted and can not be used
To return your files in work condition you need decryption tool
Follow the instructions to decrypt all your data
Do not try to change or restore files yourself, this will break them
If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB
How to get decryption tool:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: [redacted]
5) You will see payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
If you are unable to contact us through the site, then you can email us: [email protected]
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.

Get Immediate Ransomware Support

Threat actor:

Medusa

Targeted Region:

🇦🇺 Australia

🇧🇷 Brazil

🇨🇦 Canada

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Commerce and shopping

Education

Health care

Manufacturing

First seen:

01 May 2022

Description:

MedusaLocker is a ransomware group that was first discovered in October 2019. MedusaLocker operates a Dedicated Leak Site (DLS), where they publish stolen data if ransoms are not paid. The ransomware variant is notable for its use of various file extensions, which differ across samples of the malware, depending on the version or configuration of the attack.

Ransom note:

$$\      $$\ $$$$$$$$\ $$$$$$$\  $$\   $$\  $$$$$$\   $$$$$$\  
$$$\    $$$ |$$  _____|$$  __$$\ $$ |  $$ |$$  __$$\ $$  __$$\ 
$$$$\  $$$$ |$$ |      $$ |  $$ |$$ |  $$ |$$ /  \__|$$ /  $$ |
$$\$$\$$ $$ |$$$$$\    $$ |  $$ |$$ |  $$ |\$$$$$$\  $$$$$$$$ |
$$ \$$$  $$ |$$  __|   $$ |  $$ |$$ |  $$ | \____$$\ $$  __$$ |
$$ |\$  /$$ |$$ |      $$ |  $$ |$$ |  $$ |$$\   $$ |$$ |  $$ |
$$ | \_/ $$ |$$$$$$$$\ $$$$$$$  |\$$$$$$  |\$$$$$$  |$$ |  $$ |
\__|     \__|\________|\_______/  \______/  \______/ \__|  \__|
-----------------------------[ Hello, [redacted] !!! ]--------------------------

Sorry to interrupt your busy business.

WHAT HAPPEND?
------------------------------------------------------------
1. We have PENETRATE your network and COPIED data.
We have penetrated your entire network and researched all about your data.
And we have copied all of your confidential data and uploaded to private storage.

2. We have ENCRYPTED your files.
While you are reading this message, it means your files and data has been ENCRYPTED by world's strongest ransomware.
Your files have encrypted with new military-grade encryption algorithm and you can not decrypt your files.
But don't worry, we can decrypt your files.

There is only one possible way to get back your computers and servers, keep your privacy safe - CONTACT us via LIVE CHAT and pay for the special 
MEDUSA DECRYPTOR and DECRYPTION KEYs.
This MEDUSA DECRYPTOR will restore your entire network within less than 1 business day.


WHAT GUARANTEES?
---------------------------------------------------------------
We can post all of your critial data to the public and send emails to your competitors.
We have professional OSINTs and media team for leak data to telegram, facebook, twitter channels and top news websites. You can easily search about us.
You can suffer significant problems due to disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, 
 costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, and legal and regulatory issues.

After paying for the data breach and decryption, we guarantee that your data will never be leaked and make everything silent, this is also for our reputation.

YOU should be AWARE!
---------------------------------------------------------------
We will speak only with an authorized person. It can be the CEO, top management etc.
In case you ar not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company!
Inform your supervisors and stay calm!


If you do not contact us within 2 days, We will start publish your case to our official blog and everybody will start notice your incident!
--------------------[ Official blog tor address ]--------------------
Using TOR Browser(https://www.torproject.org/download/):

http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
http://wt26mlupk5sl6fmc675pbnsxnehf6dgkehb4vdp4uokbph3bb3il35id.onion/


CONTACT US!
----------------------[ Your company live chat address ]---------------------------
Using TOR Browser(https://www.torproject.org/download/):

http://medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion/[redacted]

Or Use Tox Chat Program(https://utox.org/uTox_win64.exe)
Add user with our tox ID : 4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F

Our support email: ( [email protected] )

Company identification hash:
b3bde0171684bc795bc2a91a7f48f1d80f4b07790406c17d54eca93a5c4e44e4

Get Immediate Ransomware Support

Threat actor:

Monti

Targeted Region:

🇦🇹 Austria

🇫🇷 France

🇩🇪 Germany

🇮🇹 Italy

🇺🇸 United States

Targeted industry:

Education

Health care

First seen:

05 Dec 2022

Description:

Monti is a ransomware operator group discovered in November 2022. Monti ransomware encrypts users’ sensitive files and then demands a ransom in Bitcoin (BTC) for their return. Monti ransomware operates a Dedicated Leak Site (DLS). In September 2023, the group had started using the name BIDON.

Ransom note:

All of your files are currently encrypted by MONTI strain. If you don't know who we are - just "Google it."
As you already know, all of your data has been encrypted by our software.
It cannot be recovered by any means without contacting our team directly.
DON'T
TRY TO RECOVER your data by yourselves. Any attempt to recover your
data (including the usage of the additional recovery software) can
damage your files. However,
if you want to try - we recommend choosing the data of the lowest value.
DON'T
TRY TO IGNORE us. We've downloaded a pack of your internal data and are
ready to publish it on our news website if you do not respond.
So it will be better for both sides if you contact us as soon as possible.
DON'T TRY TO CONTACT feds or any recovery companies.
We have our informants in these structures, so any of your complaints will be immediately directed to us.
So
if you will hire any recovery company for negotiations or send requests
to the police/FBI/investigators, we will consider this as a hostile
intent and initiate the publication of whole compromised data
immediately.
To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge.
You can contact our team directly for further instructions through our website :
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onion/chat/[redacted]/
Also visit our blog (via Tor):
http://mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onion/
YOU SHOULD BE AWARE
We will speak only with an authorized person. It can be the CEO, top management, etc.
In case you are not such a person - DON'T CONTACT US
Your decisions and action can result in serious harm to your company
Inform your supervisors and stay calm

Get Immediate Ransomware Support

Threat actor:

MyData

Targeted Region:

🇦🇺 Australia

🇫🇷 France

🇩🇪 Germany

🇮🇱 Israel

🇮🇹 Italy

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Business development

Education

Food and beverage

Health care

First seen:

31 Jan 2024

Description:

MyData is a ransomware group discovered in January 2024. MyData ransomware encrypts victims’ data, using encryption techniques to block access and demand a ransom for recovery.

Ransom note:

-=-=-=- Alpha ransomware -=-=-=-
-=- Visit our blog: mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id[.]onion/blog -=-
-=- Your data have been stolen and encrypted -=-
-=- You won't be able to decrypt them without our help -=-
-=- Dont try to RECOVER, DELETE or MODIFY any files, this will make it impossible to restore -=-
-=- We will help you in restoring your system, also decrypt several files for free -=-
-=- Contact us for price and get decryption software -=-
Note that this server is available via Tor browser only Follow the instructions to open the link:
mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id[.]onion
1. Type the address "https://www.torproject.org" in your Internet browser. It opens the Tor site.
2. Press "Download Tor", then press "Download Tor Browser", install and run it.
3. Now you have Tor browser. In the Tor Browser open mydatae2d63il5oaxxangwnid5loq2qmtsol2ozr6vtb7yfm5ypzo6id[.]onion
4. Copy your personal decryption key and paste it in the window that appears, enter the captcha and click the button submit.
5. Start a chat and follow the further instructions.
-----------------
Your personal decryption key:
[redacted]

Get Immediate Ransomware Support

Threat actor:

Play

Targeted Region:

🇨🇦 Canada

🇩🇪 Germany

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Information technology

Manufacturing

Real estate

First seen:

01 Aug 2022

Description:

Play is a ransomware operator group discovered in July 2022. Play ransomware encrypts a victim’s sensitive files and then demands a ransom in Bitcoin (BTC) to return the files. Play launched its Dedicated Leak Site (DLS) in November 2022 to publish stolen data from victims who refuse to pay the ransom.

Ransom note:

news portal, tor network links:
mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion
k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion
[email protected]

Get Immediate Ransomware Support

Threat actor:

Qilin

Targeted Region:

🇧🇪 Belgium

🇨🇦 Canada

🇫🇷 France

🇩🇪 Germany

🇮🇹 Italy

🇺🇸 United States

Targeted industry:

Construction

Legal

Manufacturing

First seen:

06 Nov 2022

Description:

Qilin is a ransomware operator group discovered in July 2022. In February 2023, they launched a Ransomware-as-a-Service (RaaS) platform on an underground forum. An earlier version of Qilin ransomware was known as Agenda ransomware, which was originally developed in Go. The newer version, Qilin ransomware, is developed in Rust. Despite the name change, Agenda ransomware is still used as an alternate name for Qilin. Qilin ransomware operates a Dedicated Leak Site (DLS) for publishing data stolen from victims who refuse to pay the ransom.

Ransom note:

-- Qilin
Your network/system was encrypted.
Encrypted files have new extension.
-- Compromising and sensitive data
We have downloaded compromising and sensitive data from your system/network.
Our group cooperates with the mass media.
If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog (http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion) and on the media page (https://31.41.244.100)
Data includes:
- Employees personal data, CVs, DL , SSN.
- Complete network map including credentials for local and remote services.
- Financial information including clients data, bills, budgets, annual reports, bank statements.
- Complete datagrams/schemas/drawings for manufacturing in solidworks format
- And more...
-- Warning
1) If you modify files - our decrypt software won't able to recover data
2) If you use third party software - you can damage/modify files (see item 1)
3) You need cipher key / our decrypt software to restore you files.
4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.
-- Recovery
1) Download tor browser: https://www.torproject.org/download/
2) Go to domain
3) Enter credentials-- Credentials
Extension: 
Domain: q5bwdnb3t7zbhywir5j6k3kdjhwjsa5lidwzthef2pa2qbnfk2lznxad.onion
login: 
password:

Get Immediate Ransomware Support

Threat actor:

RA Group

Targeted Region:

🇩🇪 Germany

🇹🇼 Taiwan

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Financial services

Manufacturing

Transportation

First seen:

21 Apr 2023

Description:

RA Group, discovered in April 2023, is a ransomware group that uses a variant of Babuk ransomware to encrypt data and uploads it to a remote server. They customize ransom notes for each target and append the “.GAGUP” extension to encrypted files. The group operates a Dedicated Leak Site (DLS) and utilizes qTox for communication with victims.

Ransom note:

RA World
Notification
Your data are stolen and encrypted when you read this letter.
We have copied all data to our server.
Don't worry, your data will not be made public if you do what I want.
But if you don't pay, we will release the data, contact your customers and regulators and destroy your system again.
We can decrypt some files to prove that the decrypt tool works correctly.
What we want
Contact us, pay for ransom.
If you pay, we will provide you the programs for decryption and we will delete your data where on our servers.
If not, we will leak your datas and your company will appear in the shame list below.
If not, we will email to your customers and report to supervisory authority.
How contact us
We use qTox to contact, you can download qTox from office website:
https://qtox.github.io
Our qTox ID is:
1798A384C813D95638B14D9DA5E4D98C41F58D9951FE44DCE2306459B5BDA0358C6AA519CFC1
We have no other contacts.
If there is no contact within 3 days, we will make sample files public.
If there is no contact within 7 days, we will stop communicating and release data in batches.
The longer time, the higher ransom.
RA World Office Site:
[Permanent address] http://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion
[Temporary address] http://161.35.200.18
Sample files release link:
Sample files:
[redacted]
Unpay Victim Lists
*** You'll be here too if you don't pay
*** More and more people will get your files
[redacted]
Their files can be downloaded from our site:
[Permanent address] http://raworlddecssyq43oim3hxhc5oxvlbaxuj73xbz2pbbowso3l4kn27qd.onion/share/[redacted]
[Temporary address] http://45.63.116.244/share/[redacted]
You can use Tor Browser to open .onion url.
Ger more information from Tor office website:
https://www.torproject.org

Get Immediate Ransomware Support

Threat actor:

RansomEXX

Targeted Region:

🇧🇷 Brazil

🇩🇪 Germany

🇮🇹 Italy

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Government

Government and military

Manufacturing

First seen:

22 Jun 2020

Description:

RansomExx is a ransomware family that began targeting multiple companies in mid-2020. It shares similarities with Defray777. The RansomExx group is also known by the aliases GoldDupont and Sprite Spider.

Ransom note:

Greetings, -!
 
Read this message CAREFULLY and contact someone from IT department.
Your files are securely ENCRYPTED.
No third party decryption software EXISTS.
MODIFICATION or RENAMING encrypted files may cause decryption failure.
 
You can send us an encrypted file (not greater than 400KB) and we will decrypt it FOR FREE,
so you have no doubts in possibility to restore all files from all affected systems ANY TIME.
Encrypted file SHOULD NOT contain sensitive information (technical, backups, databases, large documents).
The rest of data will be available after the PAYMENT.
Infrastructure rebuild will cost you MUCH more.
 
Contact us ONLY if you officially represent the whole affected network.
The ONLY attachments we accept are non archived encrypted files for test decryption.
Speak ENGLISH when contacting us.
 
Mail us: [email protected]
We kindly ask you not to use GMAIL, YAHOO or LIVE to contact us.
The PRICE depends on how quickly you do it.

Get Immediate Ransomware Support

Threat actor:

RansomHub

Targeted Region:

🇦🇺 Australia

🇧🇷 Brazil

🇮🇹 Italy

🇪🇸 Spain

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Information technology

Manufacturing

Real estate

First seen:

02 Feb 2024

Description:

RansomHub is a ransomware operator group first discovered in January 2024. The RansomHub ransomware encrypts victims’ data using a locker written in Golang and C++. Its asymmetric algorithm is based on x25519, while the encryption algorithm varies, using AES-256, ChaCha20, or XChaCha20, depending on hardware support. The ransomware adds random characters to the file extensions of encrypted files and operates a Dedicated Leak Site (DLS) for publishing stolen data if ransoms are not paid.

Ransom note:

We are the RansomHub.
Your company Servers are locked and Data has been taken to our servers. This is serious.
Good news:
- your server system and data will be restored by our Decryption Tool
- for now, your data is secured and safely stored on our server
- nobody in the world is aware about the data leak from your company except you and RansomHub team
Who we are
- Normal Browser Links: https://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion.ly/
- Tor Browser Links: http://ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion/
Want to go to authorities for protection
- Seeking their help will only make the situation worse,They will try to prevent you from negotiating with us, because the negotiations will make them look incompetent,After the incident report is handed over to the government department, you will be fined ,The government uses your fine to reward them.And you will not get anything, and except you and your company, the rest of the people will forget what happened
Think you can handle it without us by decrypting your servers and data using some IT Solution from third-party "specialists"
- they will only make significant damage to all of your data
every encrypted file will be corrupted forever. Only our Decryption Tool will make decryption guaranteed
Think your partner IT Recovery Company will do files restoration
- no they will not do restoration, only take 3-4 weeks for nothing
besides all of your data is on our servers and we can publish it at any time
as well as send the info about the data breach from your company servers to your key partners and clients, competitors, media and youtubers, etc.
Those actions from our side towards your company will have irreversible negative consequences for your business reputation.
You don't care in any case, because you just don't want to pay
- We will make you business stop forever by using all of our experience to make your partners, clients, employees and whoever cooperates with your company change their minds by having no choice but to stay away from your company.
As a result, in midterm you will have to close your business.
So lets get straight to the point.
What do we offer in exchange on your payment:
- decryption and restoration of all your systems and data within 24 hours with guarantee
- never inform anyone about the data breach out from your company
- after data decryption and system restoration, we will delete all of your data from your servers forever
- provide valuable advising on your company IT protection so no one can attack your again.
Now, in order to start negotiations, you need to do the following:
- install and run 'Tor Browser' from https://www.torproject.org/download/
- use 'Tor Browser' open http://sdhipwlqmxv7k4wgrrvhjfwpwapa3uxudtl5otkm757q5jyvl7gk5nqd.onion/
- enter your Client ID: [redacted]
There will be no bad news for your company after successful negotiations for both sides. But there will be plenty of those bad news if case of failed negotiations, so don't think about how to avoid it.
Just focus on negotiations, payment and decryption to make all of your problems solved by our specialists within 1 day after payment received: servers and data restored, everything will work good as new.
************************************************

Get Immediate Ransomware Support

Threat actor:

Rhysida

Targeted Region:

🇩🇪 Germany

🇮🇹 Italy

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Education

Government

Health care

Software

First seen:

1 Dec 2022

Description:

Rhysida is a ransomware group first discovered in May 2023. Rhysida ransomware encrypts victims’ data and adds the .rhysida extension to the affected files. After encryption, the ransomware uploads the compromised data to a remote server.

Ransom note:

Security notice from cyber pentesting team "Rhys1da"
Attention for Management,
The scheduled penetration testing of your network has been successfully completed. Please contact us immediately at the following email addresses to review the findings, discuss next steps, and initiate the process of returning your network to its operational state. This is an essential step to ensure the security and integrity of your network infrastructure. Your prompt response is required to expedite this process.
Your secret key [redacted]
Or write email: [email protected] \ [email protected]
For more information, please visit our website:
rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion (use Tor browser)
Attention Employees:
This logon notification is to inform you that the recent network disruptions were part of a planned security test by our IT department in collaboration with pentesting company "Rhysida". We appreciate your understanding and patience during this crucial testing phase. With approval from management pending, you may find that some business processes are not yet restored. In the meantime, feel free to enjoy a relaxed moment with a cup of coffee and some leisure time on Instagram or Facebook.
Thank you, your cybersecurity pentesting team "Rhys1da"

Get Immediate Ransomware Support

Threat actor:

Risen

Targeted Region:

🇺🇸 United States

Targeted industry:

Environmental engineering

First seen:

09 Apr 2024

Description:

Risen is a ransomware group discovered in May 2024. The ransomware encrypts victims’ data, leveraging encryption techniques to lock access. The group also operates a Dedicated Leak Site (DLS).

Ransom note:

RisenNote :
Read this text file carefully.


We have penetrated your whole network due some critical security issues.


We have encrypted all of your files on each host in the network within strong algorithm.


We have also Took your critical data such as docs, images, engineering data, accounting data, customers and ...
And trust me, we exactly know what should we collect in case of NO corporation until the end of the deadline we WILL leak or sell your data,
the only way to stop this process is successful corporation.


We have monitored your Backup plans for a whileand they are completely out of access(encrypted)


The only situation for recovering your files is our decryptor,
there are many middle man services out there whom will contact us for your caseand add an amount of money on the FIXED price that we gave to them,
so be aware of them.


Remember, you can send Upto 3 test files for decrypting, before making payment,
we highly recommend to get test files to prevent possible scams.


In order to contact us you can either use following email :


Email address : Happycat@cyberfear[.]com


Or If you weren't able to contact us whitin 24 hours please Email : bluecrap@my[.]com


Leave subject as your machine id : [redacted]


If you didn't get any respond within 72 hours use our blog to contact us, 
therefore we can create another way for you to contact your cryptor as soon as possible.
TOR BLOG : hxxp://o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd[.]onion

Get Immediate Ransomware Support

Threat actor:

SafePay

Targeted Region:

🇺🇸 United States

Targeted industry:

Construction

Education

Financial services

Health care

Legal

Manufacturing

Transportation

First seen:

September 2024

Description:

SafePay is a private ransomware operation — not a RaaS — where core developers directly orchestrate attacks rather than recruiting affiliates. This distinguishes it from the majority of active ransomware groups and contributes to its operational consistency and tight infrastructure control. Emerging in September 2024, SafePay scaled from 20+ victims in its first months to 260+ confirmed victims globally by early 2025, making it one of the fastest-growing ransomware operations in the current landscape. The group’s most significant confirmed attack was against Ingram Micro in July 2025, where 3.5TB of data was exfiltrated, causing widespread system outages affecting over 42,000 individuals.

Ransom note:

Greetings! Your corporate network was attacked by SafePay team.

Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you.

It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators.

We’ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access.

Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation.

Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties.

We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data.

In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process.

In order to contact us, please use chat below, you have 14 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us.

To contact us follow the instructions:

1) Install and run “Tor Browser” from hxxps://www.torproject.org/download/

2) Go to -

Reserve Link: -

3) Log in with ID: REDACTED

Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail.

---

Our blog:

-

Our TON blog:

tonsite://safepay.ton

You can connect through your Telegramm account.

Get Immediate Ransomware Support

Threat actor:

Sarcoma Ransomware

Targeted Region:

🇦🇺 Australia

🇦🇹 Austria

🇧🇷 Brazil

🇨🇦 Canada

🇩🇪 Germany

🇮🇹 Italy

🇹🇼 Taiwan

🇺🇸 United States

Targeted industry:

Energy

Financial services

Government

Health care

Manufacturing

Real estate

First seen:

October 2024

Description:

Sarcoma is a ransomware operation discovered in October 2024 that claimed 36 victims in its first month and reached 221 documented incidents within 18 months — one of the fastest growth trajectories in the current ransomware landscape. The group operates a double extortion model, encrypting files with a randomized extension while exfiltrating data before encryption, across both Windows and Linux environments. Their DLS and negotiation portal are hosted on the Tor network. Notable confirmed targets include Unimicron in Taiwan and a Swiss federal government supply chain breach. Sarcoma’s ransom note includes an unusual crowdsourcing section actively soliciting insider tips from disgruntled employees, which is a tactic rare among active operators.

Ransom note:

Your company is in a critical situation.
File usage is temporarily unavailable.
Backups have been destroyed.
Databases have been exported.
Data from your storages is stolen and will be published on our website or sold on the
darknet.
Sarcoma Group is the sole owner of the file restorer for your company.
Inform the boss of the company what happened ASAP.
If you want to purchase the restorer contact us, we will prepare a good price for you.
If we are not contacted by the company representative, the data will be automatically 
realized after 7 days.

Install Tor browser from https://torproject.org to access links.
Link to DLS
http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/

Link to the chat
<LINK TO CHAT>
Use Registration ID to add a new user to the chat.
<CHAT ID>

COOPERATION
If you help us find this company's dirty laundry you will be
rewarded.

You can tell your friends about us.

If you or your friend hates his boss, write to us and we will
make him cry and the real hero will get a reward from us.

Install Session messenger on your phone
Scan the QR code through the app to add us.

Get Immediate Ransomware Support

Threat actor:

ScareCrow

Targeted Region:

🇩🇪 Germany

🇮🇳 India

🇮🇹 Italy

🇵🇭 Philippines

🇷🇺 Russia

🇺🇸 United States

Targeted industry:

First seen:

November 2022.

Description:

ScareCrow ransomware operator group was discovered in November 2022. ScareCrow ransomware encrypts users’ sensitive files and demands a ransom in exchange for their return. Unlike many modern ransomware groups, ScareCrow does not operate a Dedicated Leak Site (DLS) for publishing stolen data.

Ransom note:

Telegram - @ScareCrowRestore1
@ScareCrowRestore2
@ScareCrowRestore3

Get Immediate Ransomware Support

Threat actor:

SenSayQ

Targeted Region:

🇫🇷 France

🇮🇹 Italy

Targeted industry:

Insurance

Packaging services

First seen:

05 Jun 2024

Description:

SenSayQ is a ransomware group that emerged in June 2024. The group operates a Dedicated Leak Site (DLS), where they position themselves as ethical ‘pentesters,’ claiming to care about the security of their targets. On their “About” page, they portray their actions as beneficial for security improvements. They strictly prohibit the involvement of law enforcement agencies such as the FBI, CIA, and NSA in negotiations, warning victims not to engage with these authorities.

Ransom note:

Dear managment!

---Welcome! Your are locked by SenSayQ!---

If you are reading this message, means that:

  * Your network infrastructures have been compromized!
  * Critical data has leaked!
  * Files are encrypted!
    

-----------------------------------------------------------------------
The best and only thing you can do is to contact us to settle the matter before any losses occurs. 
-----------------------------------------------------------------------

1. If you modify files - our decrypt software won't able to recover data.
2. If you use third party software - you can damage/modify files (see item 1). 
3. You need cipher key / our decrypt software to restore you files. 
4. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions.


Contacting us will be the fastest and safest solution to the problem.

-----------------------------------------------------------------------

Attention! If you do not contact us within 72 hours, we will be forced to publish the stolen data on our website.


To contact us:

1. Download and install Tor Browser - torproject.org/download
2. Follow the link: ppzmaodrgtg7r6zcputdlaqfliubmmjpo4u56l3ayckut3nyvw6dyayd.onion
3. Enter your ID: [id]


E-mail support: [email protected]

Get Immediate Ransomware Support

Threat actor:

Sinobi

Targeted Region:

🇦🇺 Australia

🇦🇹 Austria

🇧🇷 Brazil

🇨🇦 Canada

Denmark

🇫🇷 France

🇮🇹 Italy

🇬🇧 United Kingdom

🇺🇸 United States

Targeted industry:

Construction

Education

Financial services

Health care

Legal

Manufacturing

First seen:

July 2025

Description:

Sinobi emerged in July 2025 and scaled to 278 documented attacks within eight months, briefly ranking among the top three most active ransomware groups globally — an unusually rapid rise that attracted significant attention in threat intelligence communities. Infrastructure analysis suggests possible links to Lynx through shared web server frameworks and design patterns, with Prodaft reporting Sinobi may operate as a Hopeful Mantis affiliate. The group runs a resilient multi-mirror DLS infrastructure across 15 documented domains and offers victims a 7-day negotiation window with test decryption and stolen file lists as standard negotiation tools. Rclone is confirmed in use for data exfiltration. The group explicitly states financial motivation with no political agenda.

Ransom note:

Good afternoon, we are Sinobi Group.

As you can see you have been attacked by us! We offer you to make a deal with us. all you need to do is contact us by following the instructions below. 
We are not politically motivated group, we are interested only in money, we always keep our word. You have a possibility to decrypt your files and save your reputation in case we find good solution! 
You have to know we do not like procrastination. You have 7 days to come to the chat room and start negotiations.

- 1 Communication Process:
In order to contact with us you need to download Tor Browser.
You can download Tor Browser from this link:
hxxps://www[.]torproject[.]org/download/
After you joined to chat room you have the opportunity to request several things from us for free:
1. make a test decrypt.
2. get a list of the files stolen from you.
At the end, we should agree on the price for our services. Keep in mind that we got your income/insurance documents.

- 2 Access to the chat room: 
To access us please use one of the following links:
1. hxxp://sinobi7yuoppj76qnkwiobwfc2qve2xkv2ckvzyyjblwd7ucpptl62ad[.]onion/login
2. hxxp://sinobi57mfegeov2naiufkidlkpze263jtbldokimfjqmk2mye6s4yqd[.]onion/login
3. hxxp://sinobibdvzohujkliofkxiz3ueyedfh6bed2lzjz2z6pafw5jeoptsid[.]onion/login
4. hxxp://sinobibjqytwqxjw24zuerqcjyd3hoow6zia7z6kzvwawivamu7nqayd[.]onion/login
5. hxxp://sinobicrh73ongfuxjajmlyyhalvkhlcgttxkxaxz3gvsgdcgf76uiqd[.]onion/login
6. hxxp://sinobidxodgt4jsr3tlmf2rr4okjvvwfp5gh3lrqxnowomcx62ssrhqd[.]onion/login
7. hxxp://sinobiea4snfqtkc43paumapo4oi7vxcy5vjzfoalunsnvzehozfhpyd[.]onion/login

If Tor is blocked in your country you can use this link: hxxp://chat[.]sinobi[.]us[.]org/login
Your unique ID: redacted - use it to register in the chat room.

- 3 Blog:
To access us please use one of the following links:
1: hxxp://sinobi6ftrg27d6g4sjdt65malds6cfptlnjyw52rskakqjda6uvb7yd[.]onion/leaks
2: hxxp://sinobi6rlec6f2bgn6rd72xo7hvds4a5ajiu2if4oub2sut7fg3gomqd[.]onion/leaks
3: hxxp://sinobi6ywgmmvg2gj2yygkb2hxbimaxpqkyk27wti5zjwhfcldhackid[.]onion/leaks
4: hxxp://sinobi7l3wet3uqn4cagjiessuomv75aw3bvgah4jpj43od7xndb7kad[.]onion/leaks
5: hxxp://sinobi7sukclb3ygtorysbtrodgdbnrmgbhov45rwzipubbzhiu5jvqd[.]onion/leaks
6: hxxp://sinobi23i75c3znmqqxxyuzqvhxnjsar7actgvc4nqeuhgcn5yvz3zqd[.]onion/leaks
7: hxxp://sinobia6mw6ht2wcdjphessyzpy7ph2y4dyqbd74bgobgju4ybytmkqd[.]onion/leaks

If Tor is blocked in your country you can use this link: hxxp://blog[.]sinobi[.]us[.]org/leaks

- 4 Recommendations:
Do not try to recover your files with third-party programs, you will only do harm.
Do not turn off / reboot your computer.
Do not procrastinate.

Get Immediate Ransomware Support

Threat actor:

Trinity

Targeted Region:

🇨🇦 Canada

🇯🇪 Jersey

🇵🇭 Philippines

Targeted industry:

Education

Information technology

Non profit

First seen:

23 Apr 2024

Description:

Trinity is a ransomware group discovered in April 2024. Trinity ransomware encrypts victims’ data and everages the encrypted files as part of their extortion process. Trinity operates a Dedicated Leak Site (DLS), where they publish stolen data if ransom payments are not met.

Ransom note:

We downloaded to our servers and encrypted all your databases and personal information!


to contact us


download TOR


hxxps://www[.]torproject[.]org/download/


follow this link hxxp://txtggyng5euqkyzl2knbejwpm4rlq575jn2egqldu27osbqytrj6ruyd[.]onion


follow the instructions on the website


if you're having trouble with TOR



e-mail wehaveyourdata@onionmail[.]org



IMPORTANT INFORMATION!


If you do not write to us within 24 hours, we will start publishing and selling your data on the darknet on hacker sites and offer the information to your competitors


Guarantee:If we don't provide you with a decryptor or delete your data after you pay,no one will pay us in the future. We value our reputation.


Guarantee key:To prove that the decryption key exists, we can test the file (not the database and backup) for free.


Do not try to decrypt your data using third party software, it may cause permanent data loss.


Don't go to recovery companies - they are essentially just middlemen.Decryption of your files with the help of third parties may cause increased price (they add their fee to our) we're the only ones who have the decryption keys.

Get Immediate Ransomware Support

Threat actor:

Underground Team

Targeted Region:

🇫🇷 France

🇲🇾 Malaysia

🇰🇷 South Korea

🇪🇸 Spain

🇸🇪 Sweden

🇺🇸 United States

Targeted industry:

Commerce and shopping

Manufacturing

Real estate

First seen:

05 Jul 2023

Description:

Underground is a ransomware group first discovered in July 2023. The ransomware encrypts the victim’s data and uploads it to a remote server for ransom leverage. Underground does not operate a Dedicated Leak Site (DLS).

Ransom note:

The Underground team welcomes you!
We would like to inform that your network has been tested by us for vulnerabilities.
Poor network security could cause your data to be lost forever.
Your files are currently encrypted, they can be restored to their original state with a decryptor key that only we have.
The key is in a single copy on our server.
Attempting to recover data by your own efforts may result in data loss.
It is important not to change their current state. Each file additionally has a unique cipher, which you can restore only with our help.
We also examined your infrastructure and downloaded the most sensitive data.
The list of hosts from which the information was downloaded:
[redacted]
----------------------------------
-email communications with clients that contain confidential agreements
-accounting and tax reports for each client
-audit documents
-companys and clients financial documents
-clients passports/ID's and private information
-documents contain privileged and confidential information
-password-protected documents from a bank
-payroll data
-company financial and performance data
-employees personal information (Tc Identification Numbers)

The total amount of downloaded information more than [redacted] Gb
If you do not contact us within 3 days, or we cannot reach an agreement, all data will be published
on a site that no one can block.
Confidential data can be helpful for your competitors, enemies and darknet market hackers from over the world.
The consequences will be unpredictable and the process cannot be stopped.
Information about data leaks is bound to get into the media. Your company's reputation will be damaged.
We value and respect every business, including yours.
Therefore, we suggest you avoid further negative consequences and return to your work as soon as possible.
We guarantee a fair and confidential deal in the shortest possible time.
You will not only receive a decryptor, but also a description of your network vulnerabilities and information security recommendations. If necessary, you will be provided with qualified data recovery assistance.
You can trust us! Reputation is important to everyone.
As a proof of our statements, we are ready to restore some files for free and
demonstrate how our product works.
Best regards, Underground team !

Contacts for communication via chat:
login to your account
(Tor Browser)
http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/
your login: TPA
your password: [redacted]
your ID: [redacted]

Get Immediate Ransomware Support

Threat actor:

WhiteRabbit

Targeted Region:

🇩🇴 Dominican Republic

🇮🇹 Italy

🇪🇸 Spain

🇺🇸 United States

Targeted industry:

Financial services

Information technology

Insurance

First seen:

10 Dec 2021

Description:

White Rabbit ransomware was first detected on December 14, 2021. The ransomware adds the .scrypt extension to encrypted files and drops a ransom note named <filename>.scrypt.txt.

Ransom note:

--------------------------------------------------------------------------

HELLO [redacted]

If you are reading this message, means that:
- your network infrastructures have been compromised,
- critical data has leaked,
- files are encrypted

â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”“
â”ƒ Welcome to the Ransom House â”ƒ
â”ƒ You are locked by â”ƒ
â”ƒ W H I T E R A B B I T â”ƒ
â”ƒ Knock, Knock. Follow the White Rabbit... â”ƒ
â”ƒ â”ƒ
â”ƒ (\(\ â”ƒ
â”ƒ (-.-) â”ƒ
â”ƒ (")(") â”ƒ
â”ƒ â”ƒ
â”—â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”â”›

The best and only thing you can do is to contact us
to settle the matter before any losses occurs.

--------------------------------------------------------------------------

1. THE FOLLOWING IS STRICTLY FORBIDDEN

1.1 DELETION THIS NOTE.
Each note carries the encryption key
needed to decrypt the data,
don't lose it

1.2 EDITING FILES OR HDD.
Renaming, copying or moving any files
could DAMAGE the cypher and
decryption will be impossible.

1.3 USING THIRD-PARTY SOFTWARE.
Trying to recover with any software
can also break the cipher and
file recovery will become a problem.

1.4 SHUTDOWN OR RESTART THE PC.
Boot and recovery errors can also damage the cipher.
Sorry about that, but doing so is entirely at your own risk.

1.5 HIRING THE FBI AND OTHERS
Cooperating with the FBI|CIA and so on
and involving their officers in negotiations
will end our communication with you
and we will share all the leaked data for free.

--------------------------------------------------------------------------------------------------

2. EXPLANATION OF THE SITUATION
2.1 HOW DID THIS HAPPEN

The security of your IT perimeter has been compromised (it's not perfect at all).
We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks.
We spent a lot of time for researching and finding out the most important directories of your business, your weak points.
We have already downloaded a huge amount of critical data and analyzed it. Now it's fate is up to you, it will either be deleted or sold, or shared with the media.

2.2 VALUABLE DATA WE USUALLY STEAL:
- Databases, legal documents, billings, clients personal information, SSN...
- Audit reports
- Any financial documents (Statements, invoices, accounting, transfers etc.)
- work files and corporate correspondence
- Any backups

2.3 TO DO LIST (best practies)
- Contact us as soon as possible
- Contact us only in our chat, otherwise you can run into scammers.
- Purchase our decryption tool and decrypt your files. There is no other way to do this.
- Realize that dealing with us is the shortest way to the success and secrecy.
- Give up the idea of using decryption help programs, otherwise you will destroy the system permanently
- Avoid any third-party negotiators and recovery groups. They can allow the event to leak.

--------------------------------------------------------------------------------------------------

3. POSSIBLE DECISIONS
3.1 NOT MAKING THE DEAL
- After 4 days starting tomorrow your leaked data will be published or sold.
- We will also send the data to all interested supervisory organizations and the media.
- Decryption key will be deleted permanently and recovery will be impossible.
- Losses from the situation will be measured based on your annual budget

3.2 MAKING THE WIN-WIN DEAL
- You will get the Decryption Tool and the Manual how-to-use.
- You will get our guarantee and log of non-recovarable deletion of all your data.
- You will get the guarantee of secrecy and deletion of all traces of the deal in internet.
- You will get the security report on how to fix your security breaches.

--------------------------------------------------------------------------------------------------

4. EVIDENCE OF THE LEAKAGE
4.1 SCREENSHOTS:
[redacted]
[redacted]
[redacted]
[redacted]
[redacted]

4.2 DB sample: hxxps://file[.]io/[redacted]
hxxps://file[.]io/[redacted]
Password:[redacted]
--------------------------------------------------------------------------------------------------

5. HOW TO CONTACT US

5.1 Download and install TOR Browser https://torproject.org
5.2 Open our live-chat website at [redacted]
5.3 To review leaked data at temporarily server get the ftp access in our live chat
5.4 If the TOR Browser is restricted in your area then use VPN services
5.5 All your Data will be published in 4 Days in the case of silence on your side
5.6 Your Decryption keys will be permanently destroyed synchronous 5.5
5.7 Your Data will be published if you will hire third-party negotiators to contact us

--------------------------------------------------------------------------------------------------

6. RESPONSIBILITY

6.1 The breaking of critical points of this offer will cause:
- deletion of your decryption keys
- immediate selling of your data
- in the case of non-selling we will publish your data for free
- notification of government supervision agencies, your competitors and clients
--------------------------------------------------------------------------------------------------
7. Encryption Key

---BEGIN KEY---
[redacted 256 bytes base64]
---END KEY---

Get Immediate Ransomware Support