Ransomware Group intelligence
Abyss
ActiveTrack Abyss with 92 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Abyss is tracked by Breach House as a ransomware group with 92 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
92
- Leaked 5 5.4%
- Pending 87 94.6%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 3h ago | 3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion |
Top Activity Sectors (14)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Abyss, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Abyss executes PowerShell scripts to spread payloads and manipulate system processes across compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: Abyss leverages registry run keys to maintain persistence by automatically launching malware after system reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Abyss disables antivirus tools and modifies security software configurations to evade detection during infection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Abyss deletes Volume Shadow Copies and backup directories via command-line tools to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: Abyss dumps LSASS memory using credential-access tools to harvest user credentials for initial access.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1018 Remote System Discovery Discovery
What they do: Abyss performs remote system discovery to map network topology and locate high-value targets across the victim environment.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: Abyss scans network shares using native tools to identify additional victims for lateral movement and data collection.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Abyss uses SMB/Windows Admin Shares for lateral movement to propagate ransomware across networked systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: Abyss encrypts victim files using custom ransomware binaries targeting communication and marketing data for maximum disruption.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Abyss triggers system recovery inhibition by corrupting critical services and disabling backup restoration mechanisms.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (92)
Search, filter and paginate the victim timeline for Abyss. Showing 1–92 of 92.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | kingpower.com id34611 View details | United States | Energy | pending | ||
|
kingpower.com kingpower.com 1.2Tb uncompressed data Show |
||||||
| Ransomware | MEMSIC id32135 View details | United States | Manufacturing / Engineering | — | pending | |
|
Founded in 1999, MEMSIC is a company that designs, manufactures Flow sensors, Accelerometers, Sensing technology, Inertial systems, Magnetometers, Tilt sensors. MEMSIC is located in Massachusetts. |
||||||
| Ransomware | School Facility Consultants id29545 View details | Education | — | pending | ||
|
School Facility Consultants (SFC) is a full-service company that provides expert guidance in school facility planning and funding for School Districts, County Offices of Education, and Charter Schools across California. |
||||||
| Ransomware | landkreis-limburg-weilburg.de id29536 View details | Germany | Public Sector | pending | ||
|
The district administration of Limburg-Weilburg County in the state of Hesse, Germany. The organization performs local government functions and is responsible for a wide range of public services for the district's residents. |
||||||
| Ransomware | technic.com id29142 View details | United States | Manufacturing / Engineering | pending | ||
|
Founded in 1944 and headquartered in Woonsocket, Rhode Island, Technic Inc. is an international supplier of electroplating chemicals and equipment. |
||||||
| Ransomware | thinlinetech.com id26859 View details | United States | IT | pending | ||
|
Thinline Technologies offers reliable IT consulting and expert computer and network support services to businesses in the Baltimore metro area. |
||||||
| Ransomware | sitoy.com id25819 View details | Hong Kong | Retail / E-commerce | — | pending | |
|
Founded in 1968, Sitoy Group is engaged in the design, research, development, manufacturing, sale, wholesaling, and retailing of handbags, small leather goods, travel goods, and footwear products. |
||||||
| Ransomware | dillonyarn.com id24684 View details | United States | Healthcare / Pharma | — | pending | |
|
Dillon Yarn is a distributor of spun, flat and industrial yarn, as well as other incidental textile items for use in textile and related industries. |
||||||
| Ransomware | optimumdesign.com id22514 View details | United States | Services | pending | ||
|
Optimum Design Associates specializes in PCB design services, leveraging elite experience and proven methodologies to deliver high-quality electronic engineering solutions. |
||||||
| Ransomware | moinian.com id22285 View details | United States | Construction / Real Estate | pending | ||
|
Founded in 1982, The Moinian Group is a privately held real estate investment company focusing in New York City commercial, residential, and hospitality properties. |
||||||
| Ransomware | hptc.org id21372 View details | United States | Healthcare / Pharma | pending | ||
|
High Point Treatment Center, based in New Bedford, Massachusetts, offers residential and outpatient services to prevent and treat chemical dependency and provides therapeutic services for mental health issues. |
||||||
| Ransomware | crownlaboratories.com id18908 View details | United States | Healthcare / Pharma | pending | ||
|
Crown Laboratories, founded in 2000 and based in Johnson City, TN, provides pharmaceutical and ethical OTC products to the medical marketplace and contract manufacturing to the pharmaceutical industry. |
||||||
| Ransomware | entandallergy.com id18755 View details | United States | Healthcare / Pharma | pending | ||
|
ENT and Allergy Associates is an ear, nose, and throat specialist clinic, with locations throughout Southeast New York and Northern New Jersey. Their headquarters is in Tarrytown, New York. |
||||||
| Ransomware | mdm-insurance.com id18405 View details | United Kingdom | Finance / Legal / Insurance | pending | ||
|
MDM Insurance Services Inc. offers a wide range of insurance products and services, including auto, home, and life insurance. |
||||||
| Ransomware | ceratec.com id18128 View details | Canada | Communication / Marketing | pending | ||
|
Based in Quebec, Canada, Ceratec Surfaces sells a variety of home and commercial flooring products such as vinyl and tiles, and offers installation systems. |
||||||
| Ransomware | halex.com id17539 View details | United States | Communication / Marketing | pending | ||
|
Halex provides a comprehensive range of IT services specifically tailored for small to medium-sized enterprises. |
||||||
| Ransomware | Four Eye Clinics id17117 View details | United States | Healthcare / Pharma | — | pending | |
|
centuryvisionglobal.com independenceeye.com kocheye.com prairieeyecenter.com |
||||||
| Ransomware | jpcgroupinc.com id17116 View details | United States | Construction / Real Estate | pending | ||
|
JPC Group, Inc. is a full-service construction contractor with expertise in road and bridge construction, water and sewer utility work, large-scale demolition and full-service marine construction. |
||||||
| Ransomware | envirosep.com id16855 View details | United States | Energy | pending | ||
|
EnviroSep designs and manufactures integrated solutions with automation and controls for fluid handling, heat transfer and energy recovery. |
||||||
| Ransomware | kingpower.com id16543 View details | Hong Kong | Energy | — | pending | |
|
Headquartered in Bangkok, Thailand, King Power is a duty free retailer that provides travel related services and products. It currently has online shopping, outlets at airports, and major tourist venues. |
||||||
| Ransomware | berkotfoods.com id16251 View details | United States | Agriculture / Food | pending | ||
|
Berkot's Super Foods is your neighborhood, family-owned and operated, full-service grocery store. |
||||||
| Ransomware | bataviacontainer.com id16195 View details | Netherlands | Communication / Marketing | pending | ||
|
Batavia Container is devoted to providing customers with the best packaging solutions in the industry. |
||||||
| Ransomware | pez.com id15886 View details | Austria | Communication / Marketing | — | pending | |
|
PEZ was first marketed as a compressed peppermint candy in 1927 in Vienna, Austria. Today, the company sells and markets its products worldwide with locations in Orange, Connecticut and Traun, Austria. |
||||||
| Ransomware | glts.net id15637 View details | United States | Education | pending | ||
|
The Greater Lawrence Technical School is a regional technical high school serving the four communities. |
||||||
| Ransomware | anhf.org.auh id15042 View details | Australia | Hospitality / Food & Beverage / Tourism | — | pending | |
|
For over four decades, we have been providing accommodation and community care services for elderly people from Chinese and Southeast Asian backgrounds, empowering them to enjoy their senior years in comfort and fulfilment. |
||||||
| Ransomware | projektalp.ch id15037 View details | Switzerland | Communication / Marketing | pending | ||
|
Project Alp offers professionally accompanied individual places in suitable host families in agricultural establishments in the cantons of Bern, Solothurn, Fribourg and Lucerne for longer-term stays and time out placements in crisis situations. |
||||||
| Ransomware | In the depths of software development. id14776 View details | United States | IT | — | pending | |
|
Unlocking the secrets of PRM tech. Today we publish the first part from a major leak at PRM . |
||||||
| Ransomware | Promise Technology, Inc. id14775 View details | United States | IT | — | pending | |
|
We will publish every 3 days a new part, from old to new and at the end we will publish fresh source code (2024 and future developments) and internal databases 2024. |
||||||
| Ransomware | promise.com id14726 View details | United States | Communication / Marketing | — | pending | |
|
Promise Technology Inc. is a recognized global leader in the storage industry and the leading developer of high-performance storage solutions, designed for the data center, surveillance, cloud and rich media markets. |
||||||
| Ransomware | victrongroup.com id14669 View details | Viet Nam | Retail / E-commerce | — | pending | |
|
Victron Energy is a premier fuel distributor founded by Ali Sharaf. Beginning with a single convenience store, Ali grew his business by providing the best possible customer experience and was a pioneer in larger format convenience stores co-branded with restaurants. |
||||||
| Ransomware | tolsa.com id14460 View details | Spain | Services | pending | ||
|
TOLSA Minerals & Mining. Spain. Founded in 1957 TOLSA is a mining company that works in the extraction, treatment and commercialization of mineral solutions. |
||||||
| Ransomware | f-t.com id14424 View details | United States | Healthcare / Pharma | pending | ||
|
Fitzemeyer & Tocci (F&T) is a leading engineering and construction management firm that specializes in designing and building complex facilities for healthcare, academic, research, and science and technology institutions. |
||||||
| Ransomware | tims.com id14369 View details | Canada | Healthcare / Pharma | pending | ||
|
TIMS Medical offers innovative medical imaging solutions for hospitals and healthcare providers. |
||||||
| Ransomware | ecbawm.com id14283 View details | Japan | Other | pending | ||
|
Emery Celli Brinckerhoff Abady Ward & Maazel LLP is a nationally-recognized litigation boutique that focuses on civil rights, commercial, criminal, and ethics matters. |
||||||
| Ransomware | pfsbrands.com id14100 View details | United States | Retail / E-commerce | pending | ||
|
PFSbrands ® is an employee-owned company that provides three successful hot food brands primarily to the c-store and supermarket industries |
||||||
| Ransomware | comtruck.ca id14031 View details | Canada | Communication / Marketing | pending | ||
|
Providing Expert Truck Equipment Solutions across Canada. Part of the Commercial Group of Companies, Commercial Truck Equipment is Canada's largest supplier of vocational vehicles and work truck equipment |
||||||
| Ransomware | idahopacific.com id13963 View details | United States | Communication / Marketing | pending | ||
|
Idaho Pacific is a leading producer of dehydrated potato products for the foodservice, industrial and export channels |
||||||
| Ransomware | spvmhc.org id13912 View details | United States | Healthcare / Pharma | pending | ||
|
Scioto Paint Valley Mental Health Center offer a variety of Residential and Outpatient counseling treatment centers in these counties: Ross, Fayette, Highland, Pike, and Pickaway. |
||||||
| Ransomware | robertshvac.com id13778 View details | United States | Communication / Marketing | pending | ||
|
robertshvac.com 240Gb uncompressed data |
||||||
| Ransomware | q-cells.de id13661 View details | Germany | Communication / Marketing | pending | ||
|
q-cells.de 5.4Tb uncompressed data |
||||||
| Ransomware | zoppo.com id13590 View details | United States | Communication / Marketing | pending | ||
|
zoppo.com 233Gb uncompressed data |
||||||
| Ransomware | crimsonwinegroup.com id13521 View details | United States | Communication / Marketing | pending | ||
|
crimsonwinegroup.com.com 1.6Tb uncompressed data |
||||||
| Ransomware | greenlightbiosciences.com id13347 View details | Communication / Marketing | — | pending | ||
|
greenlightbiosciences.com 726Gb uncompressed data |
||||||
| Ransomware | landmarklife.com id13186 View details | United States | Communication / Marketing | pending | ||
|
landmarklife.com 2.4Tb uncompressed data |
||||||
| Ransomware | conferenceusa.com id13185 View details | United States | Communication / Marketing | — | pending | |
|
conferenceusa.com 1Tb uncompressed data |
||||||
| Ransomware | tpocc.org id13148 View details | United States | Communication / Marketing | pending | ||
|
tpocc.org 570Gb uncompressed data |
||||||
| Ransomware | malca-amit.com id13060 View details | Israel | Other | — | pending | |
|
malca-amit.com 30Gb + VMware images CHKC-NGSQL.MAFE.COM HKG-TSPLS.MAFE.COM 1.2Tb |
||||||
| Ransomware | woldae.com id12366 View details | United States | Communication / Marketing | pending | ||
|
woldae.com 9.7Tb uncompressed data |
||||||
| Ransomware | rangam.com id12117 View details | United States | Communication / Marketing | leaked | ||
|
rangam.com 1.1Tb uncompressed data |
||||||
| Ransomware | rameywine.com id11453 View details | United States | Communication / Marketing | pending | ||
|
rameywine.com 61Gb uncompressed data |
||||||
| Ransomware | lindquistinsurance.com id11390 View details | United States | Finance / Legal / Insurance | — | pending | |
|
lindquistinsurance.com 12Gb uncompressed data |
||||||
| Ransomware | iamdesign.com id11218 View details | Italy | Communication / Marketing | — | pending | |
|
iamdesign.com 78Gb uncompressed data |
||||||
| Ransomware | yarco.com id11217 View details | United States | Communication / Marketing | — | pending | |
|
yarco.com 1.9Tb uncompressed data |
||||||
| Ransomware | neigc.com id11161 View details | United States | Communication / Marketing | — | pending | |
|
neigc.com 2.9Tb uncompressed data |
||||||
| Ransomware | sunharbormanor.com id11026 View details | United States | Communication / Marketing | — | pending | |
|
sunharbormanor.com 91Gb uncompressed data |
||||||
| Ransomware | vanwingerden.com id10840 View details | United States | Communication / Marketing | — | leaked | |
|
vanwingerden.com 337Gb uncompressed data |
||||||
| Ransomware | mranet.org id10754 View details | United States | Communication / Marketing | — | pending | |
|
mranet.org 3Tb uncompressed data |
||||||
| Ransomware | posen.com id10728 View details | United States | Communication / Marketing | — | leaked | |
|
Posen Architects 724Gb uncompressed data |
||||||
| Ransomware | transaxle.com id10715 View details | United States | Communication / Marketing | — | leaked | |
|
transaxle.com 795Gb uncompressed data |
||||||
| Ransomware | deltron.com id10701 View details | United States | Communication / Marketing | — | leaked | |
|
deltron.com 8.9Gb uncompressed data |
||||||
| Ransomware | vidalung.ai id10588 View details | United States | Communication / Marketing | — | pending | |
|
vidalung.ai 1.7Tb uncompressed data |
||||||
| Ransomware | synergyfinancialgrp.com id10535 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Synergy Financial Group 97Gb uncompressed data |
||||||
| Ransomware | micrometals.com id10534 View details | United States | Manufacturing / Engineering | — | pending | |
|
Micrometals, Inc. 997Gb uncompressed data |
||||||
| Ransomware | concertus.co.uk id9851 View details | United Kingdom | Communication / Marketing | — | pending | |
|
Concertus Design and Property Consultants 1,9Tb uncompressed data |
||||||
| Ransomware | aurobindousa.com id9798 View details | Communication / Marketing | — | pending | ||
|
Aurobindo 3,7Tb uncompressed data |
||||||
| Ransomware | shawneemilling.com id9488 View details | Communication / Marketing | — | pending | ||
|
Shawnee Mills 805Gb uncompressed data |
||||||
| Ransomware | motordepot.co.uk id9487 View details | United Kingdom | Communication / Marketing | — | pending | |
|
Motor Depot 636Gb uncompressed data |
||||||
| Ransomware | lathamcenters.org id9394 View details | Communication / Marketing | — | pending | ||
|
lathamcenters.org 75Gb uncompressed data |
||||||
| Ransomware | apexga.bank id9230 View details | Finance / Legal / Insurance | — | pending | ||
|
apexga.bank 5 VMware VM from Production Servers |
||||||
| Ransomware | njsba.com id8564 View details | Communication / Marketing | — | pending | ||
|
NJSBA , 529Gb uncompressed data |
||||||
| Ransomware | www.northriverco.com id8555 View details | Communication / Marketing | — | pending | ||
|
North River Co LLC, 303Gb uncompressed data |
||||||
| Ransomware | www.lasaterandmartin.com id8403 View details | Finance / Legal / Insurance | — | pending | ||
|
Lasater & Martin, P.C. Attorneys, 697Gb uncompressed data |
||||||
| Ransomware | www.finitia.net id8087 View details | Communication / Marketing | — | pending | ||
|
finitia ag, 465Gb uncompressed data |
||||||
| Ransomware | plbint.com id7406 View details | Communication / Marketing | — | pending | ||
|
PLB International, 990Gb uncompressed data |
||||||
| Ransomware | www.brockhouse.co.uk id7341 View details | United Kingdom | Communication / Marketing | — | pending | |
|
Brockhouse Group Ltd, 35Gb uncompressed data |
||||||
| Ransomware | www.tractrad.com id7331 View details | Communication / Marketing | — | pending | ||
|
Tractrad.com, 35Gb uncompressed data |
||||||
| Ransomware | www.stri.se id7314 View details | Sweden | Communication / Marketing | — | pending | |
|
STRI, 189Gb uncompressed data |
||||||
| Ransomware | www.arb.ch id7313 View details | Switzerland | Communication / Marketing | — | pending | |
|
arb Architekten AG, 220Gb uncompressed data |
||||||
| Ransomware | www.l3harris.com id6445 View details | Communication / Marketing | — | pending | ||
|
17 VM from wsots.net (Wideband Satellite Communications Operations and Technical Support) |
||||||
| Ransomware | wsots.net id6443 View details | Communication / Marketing | — | pending | ||
|
17 VM from wsots.net (Wideband Satellite Communications Operations and Technical Support) |
||||||
| Ransomware | pwlawfirm.com id6422 View details | Finance / Legal / Insurance | — | pending | ||
|
Piasecki & Whitelaw, LLC 385G uncompressed data |
||||||
| Ransomware | brett-robinson.com id6371 View details | Manufacturing / Engineering | — | pending | ||
|
Brett-Robinson, 393Gb database backups and data from production servers |
||||||
| Ransomware | avidxchange.com id6370 View details | Manufacturing / Engineering | — | pending | ||
|
AvidXchange, Inc All database backups from production servers |
||||||
| Ransomware | pandol.com id6158 View details | Communication / Marketing | — | pending | ||
|
Pandol Bros., Inc 389Gb uncompressed data |
||||||
| Ransomware | 7x7oralsurgery.com id5971 View details | Healthcare / Pharma | — | pending | ||
|
7x7 Dental Implant & Oral Surgery 114Gb uncompressed data |
||||||
| Ransomware | bienvilleortho.com id5924 View details | Communication / Marketing | — | pending | ||
|
bienvilleortho.com 147Gb uncompressed data |
||||||
| Ransomware | largest provider of orthopedic care id5810 View details | Communication / Marketing | — | pending | ||
|
147Gb uncompressed data |
||||||
| Ransomware | hosemanufacturing.com id5791 View details | Manufacturing / Engineering | — | pending | ||
|
Ratermann Manufacturing 113Gb uncompressed data |
||||||
| Ransomware | igadiltd.com id5790 View details | Communication / Marketing | — | pending | ||
|
IgadI 84Gb uncompressed data |
||||||
| Ransomware | jones-hamilton.com id5789 View details | Communication / Marketing | — | pending | ||
|
Jones-Hamilton Co. 230Gb uncompressed data |
||||||
| Ransomware | stonehillcontracting.com id5788 View details | Communication / Marketing | — | pending | ||
|
Stone Hill Contracting, Inc. 176Gb uncompressed data |
||||||
| Ransomware | siebold.com id5787 View details | Communication / Marketing | — | pending | ||
|
The Siebold Company, Inc. 700Gb uncompressed data |
||||||