Ransomware Group intelligence
Akira
ActiveTrack Akira with 1703 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Akira is tracked by Breach House as a ransomware group with 1703 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
1617
- Leaked 48 3.0%
- Pending 1569 97.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Up checked 4h ago | akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion |
| Leak location 1 | Onion service | Up checked 4h ago | akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion |
Top Activity Sectors (18)
- Finance / Legal / Insurance 427
- Communication / Marketing 320
- Manufacturing / Engineering 172
- Services 130
- Construction / Real Estate 106
- Not identified 75
- IT 66
- Healthcare / Pharma 66
- Energy 40
- Transportation / Travel / Logistics 33
- Hospitality / Food & Beverage / Tourism 33
- Agriculture / Food 32
- Retail / E-commerce 29
- Telecommunications 28
- Education 25
- Public Sector 16
- NGOs / Associations 5
- null 1
Typical Attacks (29)
▼How Akira typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Akira, Akira, Akira _v2.
-
What they do: Akira uses valid account information to remotely access victim networks, such as VPN credentials.
What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
-
What they do: Akira uses compromised VPN accounts for initial access to victim networks.
What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
-
T1047 Windows Management Instrumentation Execution
What they do: Akira will leverage COM objects accessed through WMI during execution to evade detection.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
T1059.001 PowerShell Execution
What they do: Akira has used PowerShell scripts for credential harvesting and privilege escalation.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1059.003 Windows Command Shell Execution
What they do: Akira executes from the Windows command line and can take various arguments for execution.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
What they do: Akira _v2 can create a child process for encryption.
What that means: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
-
T1027.001 Binary Padding Stealth
What they do: Akira has used binary padding to obfuscate payloads.
What that means: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: Akira has used legitimate names and locations for files to evade defenses.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1480 Execution Guardrails Stealth
What they do: Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.
What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Akira has disabled or modified security tools for defense evasion.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1558 Steal or Forge Kerberos Tickets Credential Access
What they do: Akira have used scripts to dump Kerberos authentication credentials.
What that means: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.
-
T1018 Remote System Discovery Discovery
What they do: Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1057 Process Discovery Discovery
What they do: Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1082 System Information Discovery Discovery
What they do: Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.
What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
T1083 File and Directory Discovery Discovery
What they do: Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1135 Network Share Discovery Discovery
What they do: Akira can identify remote file shares for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1482 Domain Trust Discovery Discovery
What they do: Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.
What that means: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
-
T1654 Log Enumeration Discovery
What they do: Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.
What that means: Adversaries may enumerate system and service logs to find useful data.
-
T1021.001 Remote Desktop Protocol Lateral Movement
What they do: Akira has used RDP for lateral movement.
What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
-
T1213.002 Sharepoint Collection
What they do: Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.
What that means: Adversaries may leverage the SharePoint repository as a source to mine valuable information.
-
T1560.001 Archive via Utility Collection
What they do: Akira uses utilities such as WinRAR to archive data prior to exfiltration.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1219 Remote Access Tools Command and Control
What they do: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.
What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: Akira will exfiltrate victim data using applications such as Rclone.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: Akira encrypts files in victim environments as part of ransomware operations.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Akira _v2 can stop running virtual machines.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Akira will delete system volume shadow copies via PowerShell commands.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1531 Account Access Removal Impact
What they do: Akira deletes administrator accounts in victim networks prior to encryption.
What that means: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
-
T1657 Financial Theft Impact
What they do: Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.
What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.
Tools Observed (41)
▼Software Akira has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
DonPAPI
LaZagne
Mimikatz
Defense evasion
PowerTool
Zemana Anti-Rootkit driver
Zemana Anti-Rootkit
Discovery
Advanced IP Scanner
Masscan
ReconFTW
SharpHound
SoftPerfect NetScan
Discovery & enumeration
Advanced IP Scanner
Bloodhound
ldapdomaindump
Masscan
ReconFTW
SharpHound
SharpShares
SoftPerfect NetScan
Exfiltration
FileZilla
MEGA
RClone
Temp[.]sh
WinSCP
Networking & tunnelling
Cloudflared
OpenSSH
Ngrok
OffSec
Impacket
Offensive security tooling
CrackMapExec
Impacket
NetExec
RMM Tools
AnyDesk
MobaXterm
Radmin
RustDesk
Remote monitoring & management
AnyDesk
MeshAgent
MobaXterm
Radmin
RustDesk
TeamViewer
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Crypto Wallets (15)
▼
$3,991,216
Received (USD)
24
Payments
15
Known wallets
$997,459
Largest single payment
2023-07-13 → 2024-09-17
Payment window
bitcoin · 15
| Address | Chain | Received (USD) | Payments |
|---|---|---|---|
bc1qr0pqfghr9cksfc5arr2rak3lt2y50v03pc76nh |
bitcoin | $997,461 | 2 |
bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdaj |
bitcoin | $482,181 | 1 |
bc1q0dx45y82r5rt36sm38jv0k4dexwc4nj9z4ryw7 |
bitcoin | $446,073 | 2 |
bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2 |
bitcoin | $351,883 | 1 |
bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6h |
bitcoin | $298,537 | 2 |
bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24 |
bitcoin | $252,389 | 1 |
bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mc |
bitcoin | $229,395 | 4 |
bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8 |
bitcoin | $150,205 | 1 |
bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtah |
bitcoin | $149,891 | 1 |
bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkyd |
bitcoin | $139,534 | 1 |
bc1qpwwtck0zhzrj56fxeayz6wz5546nlp607qzpvh |
bitcoin | $109,655 | 2 |
bc1qghj85gz0dkr9jeucana3z4xu50ujtllj50rvj0 |
bitcoin | $106,115 | 2 |
+3 more wallets not shown (the 12 largest by amount received are listed).
Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122
Ransom Notes (3)
▼The note this group leaves on a compromised machine. Click a filename to read it.
akira_readme_3.txt
Hi friends, Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. ATTENTION! Strictly prohibited: - Deleting files with .arika extension; - Replacing or renaming .arika and .akira files; - Using third party software to recover your systems. If you violate these rules, we cannot guarantee a successful recovery. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion. 5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us. 6. Negotiations with Akira can only be conducted in a chat room, which you can access using the login details provided below or in the notes (a readme.txt file) in your systems. You should ignore any attempts (such as emails/social media messages, phone calls, etc.) to redirect you to another chat or email address (proton.me is often used by unauthorized individuals) on our behalf. 7. Be careful while working with recovery agencies as they often try to use your cyber incident to stuff their pockets. There are many risks for you to lose money and get nothing in return. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - torproject[.]org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] . 3. Use this code - [snip] - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.
akira_readme_2.txt
Hi friends, Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. ATTENTION! Strictly prohibited: - Deleting files with .arika extension; - Replacing or renaming .arika and .akira files; - Using third party software to recover your systems. If you violate these rules, we cannot guarantee a successful recovery. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion. 5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - torproject[.]org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] . 3. Use this code - [snip] - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.
akira_readme.txt
Hi friends, Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption. Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know: 1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal. 2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help. 3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data. 4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion. 5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us. If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions: 1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/. 2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion. 3. Use this code - [snip] - to log into our chat. Keep in mind that the faster you will get in touch, the less damage we cause.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (1703)
Search, filter and paginate the victim timeline for Akira. Showing 1101–1200 of 1703.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | DA Capital id17564 View details | United States | Finance / Legal / Insurance | — | pending | |
|
DA Capital LLC is a global investment manager specializing in cre dit and special situations. We are ready to upload a lot of sensitive corporate documents suc h as: NDA’s, employee credit cards, confidential licenses, agreem ents and contracts, employee medical cards, insurance documents, passports and visas, tax information, driver licenses, contact nu mbers and e-mail addresses of employees and customers, etc. |
||||||
| Ransomware | COSMED id17563 View details | Italy | Finance / Legal / Insurance | — | pending | |
|
COSMED is a privately owned company manufacturing Cardio Pulmonar y, Metabolic and Body Composition diagnostic equipment. We are ready to upload more than 25 GB of essential corporate doc uments such as: passport scans, NDAs, confidential files, financi al data (audits, payment details, reports), foreigner identity ca rds, etc. |
||||||
| Ransomware | Primaveras id17533 View details | Brazil | Communication / Marketing | — | pending | |
|
Primaveras has its own complete structure to take care of everyth ing in the event of a death. It consists of two cemeteries, funer al homes, wakes, crematorium, columbarium, ashes storage area, fu neral assistance plan and support services for the bereaved. We are ready to upload more than 11 GB of essential corporate doc uments such as: passport scans, contact numbers and e-mail addres ses of employees and customers, financial data (audits, payment d etails, reports), foreigner identity cards, etc. |
||||||
| Ransomware | Nelson & Townsend, CPA's id17531 View details | United States | Services | — | pending | |
|
Nelson & Townsend, CPA's perform tax returns for individuals and businesses, accounting services (payroll services, bookkeeping), and business/client support. We are ready to upload a lot of essentials corporate documents su ch as: driver licenses, financial data (audits, payment details, reports), contact numbers and e-mail addresses of employees and c ustomers, etc. |
||||||
| Ransomware | Castle Rock Construction Company id17530 View details | United States | Construction / Real Estate | — | pending | |
|
Castle Rock Roofing & Restoration will provide you with an honest evaluation of your property with no strings attached. If damage is present, Castle Rock Roofing will guide you step by step throu gh the claim process. We are ready to upload more than 16 GB of sensitive corporate doc uments such as: NDA’s, driver licenses, health insurance document s, SSN’s, contact numbers and e-mail addresses of employees and c ustomers, internal financial documents, etc. |
||||||
| Ransomware | Genus id17529 View details | United Kingdom | Communication / Marketing | — | pending | |
|
Genus is the most comprehensive low-code application development platform to rapidly build and continuously improve enterprise app lications. We are ready to upload some of essentials corporate documents suc h as: NDA’s, contact numbers and e-mail addresses of employees an d customers, financial data (audits, payment details, reports), e tc. |
||||||
| Ransomware | Window World of Raleigh id17528 View details | United States | Energy | — | pending | |
|
Window World® is America's Exterior Remodeler, offering quality w indows, doors, siding, shutters, and more, with over 200 location s nationwide. We are ready to upload some of essential corporate documents such as: NDA with employees and clients, medical insurance documents , contact numbers and e-mail addresses of employees and customers , financial data (audits, payment details, reports), etc. |
||||||
| Ransomware | Go Strictly id17526 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Go Strictly goal to help each of our customers make the most of t heir IT environments; whether managing and modernizing their curr ent systems or helping them incorporate new technologies. We are ready to upload some essentials corporate documents such a s: financial data (audits, payment details, reports), confidentia l licenses, agreements and contracts, HR documents, contact numbe rs and e-mail addresses of employees and customers, etc. |
||||||
| Ransomware | Regency Media id17523 View details | Australia | Communication / Marketing | — | pending | |
|
Regency Media, with a rich history spanning over 40 years, was on ce a leader in manufacturing optical discs, VHS, and audio casset tes for Australia's top film entertainment and recorded music com panies, as well as independent distributors. We are ready to upload more than 16 GB of essential corporate dat a such as: NDA’s, driver licenses, passports, contact numbers and e-mail addresses of employees and customers, financial data (aud its, payment details, reports), etc. |
||||||
| Ransomware | CoMo-Industrial Engineering id17512 View details | Germany | Manufacturing / Engineering | — | pending | |
|
CoMo Industrial Engineering offers a comprehensive range of indus trial engineering services. From precise piping design and flexib ility analysis to strength calculations for pressure vessels and storage tanks. We are ready to upload more than 17 GB of essential corporate doc uments such as: financial data (audits, payment details, reports) , contact numbers and e-mail addresses of employees and customers , etc. |
||||||
| Ransomware | Dan Eckman CPA id17503 View details | United States | Finance / Legal / Insurance | — | pending | |
|
an Eckman CPA offer personal tax services along with a suite of small business accounting solutions that inclu des bookkeeping, tax planning and preparation, and fina ncial reporting. You will find more than 10 GB of private corporate docu ments such as: financial data (audits, payment details, reports), contact numbers and e-mail addresses of empl oyees and customers, internal confidential agreements a nd contracts, inside corporate correspondence, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:884A5E0AFDF5F0ED8193DA7 B2CD439A9F5852331&dn=eckmancpa.com&tr=udp://tracker.ope nbittorrent.com:80/announce&tr=udp://tracker.opentrackr .org:1337/announce |
||||||
| Ransomware | Elite Advanced LaserCorporation id17502 View details | Taiwan, Province of China | Finance / Legal / Insurance | — | pending | |
|
Elite Advanced Laser Corporation (eLASER ), headquartered in Chun g Ho Dist, New Taipei City, Taiwan, is a EMS (Electronic Manufact uring Service) service of advanced optoelectronic and RF componen t for information , optical and RF communication. We are ready to upload more than 90 GB of essential corporate doc uments such as: many NDA’s, financial data (audits, payment detai ls, reports), confidential licenses, agreements and contracts, co ntact numbers and e-mail addresses of employees and customers, et c. |
||||||
| Ransomware | Vicky Foods id17474 View details | Spain | Manufacturing / Engineering | — | pending | |
|
Vicky Foods Company have an egg factory in Terrateig, a plastic f ilm packaging factory in La Pobla del Duc and a factory that prod uces and packages dried fruits and nuts in Las Palmas. We are ready to upload more than 10 GB of sensitive corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, DNI numbers, personal signatures, financial data (audits, payment details, reports), confidential licenses, agreem ents and contracts, etc. |
||||||
| Ransomware | Wakefield & Associates id17430 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Wakefield & Associates is a financial services company that speci alizes in debt collection and billing services. We are ready to upload more than 13 GB of sensitive private corpo rate documents such as: SSNs, passport numbers, confidential lice nses, agreements and contracts, financial data (audits, payment d etails, reports), contact numbers and e-mail addresses of employe es and customers, medical insurance documents, internal correspon dences, medicare numbers, etc. |
||||||
| Ransomware | Prime Trust Financial id17429 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Prime Trust Financial offers a range of financial services includ ing bill payment, cambio, financing, gift cards, and send/receive money. Their services cater to individuals looking to pay bills, shop gift cards, exchange currency, and obtain micro-financing l oans. We are ready to upload more than 68 GB of sensitive corporate doc uments such as: driver licenses, passports, contact numbers and e -mail addresses of employees and customers, financial data (audit s, payment details, reports), confidential licenses, agreements a nd contracts, etc. |
||||||
| Ransomware | Allen & Pinnix id17358 View details | United States | Healthcare / Pharma | — | pending | |
|
Allen & Pinnix, P.A. is a leading North Carolina-based law firm, serving clients around the world for over thirty-five years. We are ready to upload more than 29 GB of private corporate docu ments such as: NDAs, medical documents, contact numbers and e-mai l addresses of employees and customers, birth certificate’s, driv er licenses, passports, etc. |
||||||
| Ransomware | The Pawn id17357 View details | Hong Kong | Finance / Legal / Insurance | — | pending | |
|
The Pawn is a company that operates in the Banking industry. We are ready to upload some essential corporate documents such as : contact numbers and e-mail addresses of employees and customers , financial data (audits, payment details, reports), confidential licenses, agreements and contracts, etc. |
||||||
| Ransomware | Old National Events Plaza id17295 View details | United States | Finance / Legal / Insurance | — | pending | |
|
The impressive 280,000 square-foot, state-of-the-art facility, of fers affordable, flexible space and in-house services to make the planning and coordinating of your event a breeze. We are ready to upload a lot of sensitive corporate documents suc h as: confidential licenses, agreements and contracts, financial data (audits, payment details, reports), contact numbers and e-ma il addresses of employees and customers, etc. |
||||||
| Ransomware | Tropical Foods Company Inc id17261 View details | United States | Agriculture / Food | — | pending | |
|
Tropical Foods specializes in premium raw and freshly roasted nut s and seeds, dried fruit, snack mixes, bulk & packaged candies, s pices and specialty foods. We are ready to upload more than 56 GB of sensitive corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, financial data (audits, payment details, reports) , confidential licenses, agreements and contracts, etc. |
||||||
| Ransomware | NG-BLU Networks id17251 View details | Netherlands | Telecommunications | — | pending | |
|
NGBLU provides partners with unique, innovative and infrastructur e-independent telecommunications and data services. We are ready to upload a lot of sensitive corporate documents suc h as: contact numbers and e-mail addresses of employees and custo mers, financial data (audits, payment details, reports), confiden tial agreements and contracts, employee BSN and passport numbers and scans, etc. |
||||||
| Ransomware | Presence From Innovation (PFI) id17250 View details | United States | Communication / Marketing | — | pending | |
|
Manufacturer and Distributor of Custom Retail Store Displays and Fixtures made of Plastic, Wood, Metal, or Wire. We are ready to upload more than 13 GB of sensitive corporate doc uments such as: confidential agreements and contracts, driver lic ense numbers, HR documents, contact numbers and e-mail addresses of employees and customers, financial data (audits, payment detai ls, reports), etc. |
||||||
| Ransomware | mielectric.com.br id17206 View details | Brazil | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | engineeredequip.com id17205 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | emin.cl id17204 View details | Chile | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | alphascriptrx.com id17203 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | premierop.com id17202 View details | United Kingdom | Communication / Marketing | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | acesaz.com id17201 View details | Türkiye | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | mipa.com.br id17200 View details | Brazil | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | usm-americas.com id17199 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | feheq.com id17198 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | stewartautosales.com id17197 View details | United States | Retail / E-commerce | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | milleraa.com id17196 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | jsfrental.com id17195 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | summitmovinghouston.com id17194 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | dwgp.com id17193 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | easycom.com id17192 View details | Colombia | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | alfa.com.co id17191 View details | Colombia | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | westernwoodsinc.com id17190 View details | United States | Services | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | viscira.com id17189 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | elitt-sas.fr id17188 View details | France | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | cfctech.com id17187 View details | United States | IT | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | armellini.com id17186 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | mbacomputer.com id17185 View details | United States | IT | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | directex.net id17184 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | 360energy.com.ar id17183 View details | Argentina | Energy | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | saludsa.com.ec id17182 View details | Ecuador | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | intercomp.com.mt id17181 View details | Malta | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 2 |
||||||
| Ransomware | Taking stock of 2024| Part 2 id17169 View details | Communication / Marketing | — | pending | ||
|
Our team was able to breach the IT defenses of a huge number of c ompanies over the past year. Among them are: | intercomp.com.mt | saludsa.com.ec | 360energy.com.ar | directex .net | mbacomputer.com | armellini.com | cfctech.com | elitt-sas. fr | viscira.com | westernwoodsinc.com | alfa.com.co | easycom.co m | dwgp.com | summitmovinghouston.com | jsfrental.com | milleraa .com | stewartautosales.com | feheq.com | usm-americas.com | mipa l.com.br | acesaz.com | premierop.com | alphascriptrx.com | emin. cl | engineeredequip.com | mielectric.com.br | We always act hone stly and try not to disclose the fact of data leakage until the v ery last moment. Therefore, it is in your best interest not to be on this list and contact us immediately. |
||||||
| Ransomware | vanguardpaints.com id17068 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | Taking stock of 2024 | Part 1 id17069 View details | Construction / Real Estate | — | pending | ||
|
Our team was able to breach the IT defenses of a huge number of companies over the past year. Among them are: worldfabricinc.com, JFGV.ca, atlanticelectrics.com, cannara.ca, njcar.org, yhti.com, dkgrar.com, calfaucets.com, atr.com, simcointeriors.com, madisonforms.com, scrantonrealtors.org, isisecurity.com, sgbllp.com, ad.snadc.com, clarkpower.com, allbrightcotton.com, idrefjall.com, swissit.cz, irisib.com, foxconstructiongroup.co.uk, elf.uk.com, farmatodo.com, omniflow.com, rqsi.com, teligentems.com, centerracoop.com, andrewlauren.com, garcesfruit.com, ibp.com, empereon-constar.com, rightofwayequipment.net, adhydraclean.com, vanguardpaints.com. We always act honestly and try not to disclose the fact of data leakage until the very last moment. Therefore, it is in your best interest not to be on this list and contact us immediately. |
||||||
| Ransomware | adhydraclean.com id17067 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | rightofwayequipment.net id17066 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | empereon-constar.com id17065 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | ibp.com id17064 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | garcesfruit.com id17063 View details | Chile | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | andrewlauren.com id17062 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | centerracoop.com id17061 View details | Serbia | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | teligentems.com id17060 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | rqsi.com id17059 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | omniflow.com id17058 View details | Portugal | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | farmatodo.com id17057 View details | Venezuela, Bolivarian Republic of | Agriculture / Food | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | elf.uk.com id17056 View details | United Kingdom | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | foxconstructiongroup.co.uk id17055 View details | United Kingdom | Construction / Real Estate | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | irisib.com id17054 View details | United Kingdom | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | swissit.cz id17053 View details | Czechia | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | idrefjall.com id17052 View details | Sweden | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | allbrightcotton.com id17051 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | clarkpower.com id17050 View details | United States | Energy | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | ad.snadc.com id17049 View details | Andorra | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | sgbllp.com id17048 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | isisecurity.com id17047 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | scrantonrealtors.org id17046 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | madisonforms.com id17045 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | simcointeriors.com id17044 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | atr.com id17043 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | calfaucets.com id17042 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | dkgrar.com id17041 View details | Denmark | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | yhti.com id17040 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | njcar.org id17039 View details | United States | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | cannara.ca id17038 View details | Canada | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | atlanticelectrics.com id17037 View details | United Kingdom | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | JFGV.ca id17036 View details | Canada | Other | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | worldfabricinc.com id17035 View details | United States | Services | — | pending | |
|
Extract from Taking stock of 2024 Part 1 |
||||||
| Ransomware | Perfect Plastic id17019 View details | Manufacturing / Engineering | — | pending | ||
|
A world leader in payment card production. Innovative solutions i n contactless, EMV, chip cards, and personalization. We are ready to upload a lot of private corporate documents such as: confidential agreements and contracts, driver licenses, finan cial data (audits, payment details, reports), contact numbers and e-mail addresses of employees and customers, etc. |
||||||
| Ransomware | Benuta id17018 View details | Germany | Finance / Legal / Insurance | — | pending | |
|
In just twelve years, Benuta has become one of the fastest growin g companies in the European online carpet retail sector. We are ready to upload a lot of private corporate documents such as: NDAs, contact numbers and e-mail addresses of employees and c ustomers, financial data (audits, payment details, reports), conf idential agreements and contracts, inside correspondence, HR docu ments, etc. |
||||||
| Ransomware | Menway id17015 View details | France | Finance / Legal / Insurance | — | pending | |
|
Menway offers a wide range of skills to provide a tailor-made res ponse to all HR issues, serving businesses and employees. We are ready to upload more than 20 GB of private corporate docum ents such as: NDAs, HR documents, contact numbers and e-mail addr esses of employees and customers, financial data (audits, payment details, reports), etc. |
||||||
| Ransomware | Mark ResolveInc id16955 View details | United States | Services | — | pending | |
|
This organization primarily operates in the Business Co nsulting, nec business / industry within the Engineerin g, Accounting, Research, and Management Services sector . You will find more than 13 GB of private corporate docu ments such as: driver licenses, internal financial docu ments, inside corporate correspondence, customer contac t emails and phones, etc We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:2BAAC706035AA9FA370691A 9C31B0977C541AC59&dn=mresolve.local&tr=udp://tracker.op enbittorrent.com:80/announce&tr=udp://tracker.opentrack r.org:1337/announce&tr=wss://wstracker.online |
||||||
| Ransomware | QCN CO., LTD id16954 View details | Taiwan, Province of China | Services | — | pending | |
|
The company provides numerous consulting services and develops sy stems and applications. Based on the accumulated technology and e xperience, QCN has been opening new business lines since 2010 und er two mottos: mobile solutions and overseas cooperation projects . We are ready to upload more than 12 GB of private corporate docum ents such as: contact numbers and e-mail addresses of employees a nd customers, financial data (audits, payment details, reports), confidential agreements and contracts, etc. |
||||||
| Ransomware | Mercy Supply Collaborative id16948 View details | United States | Healthcare / Pharma | — | pending | |
|
Mercy is a diversified, privately held healthcare services organi zation, focused on positioning itself to meet the challenges of a n increasingly complex healthcare environment. We are ready to upload a lot of private corporate documents such as: financial data (audits, payment details, reports), contact nu mbers and e-mail addresses of employees and customers, etc. |
||||||
| Ransomware | Grand Fire Protection id16941 View details | United States | Communication / Marketing | — | pending | |
|
Grand Fire provides first-class fire protection and underground u tility services in Nashville and Middle Tennessee. We are ready to upload a lot of private corporate documents such as: license agreements, financial data (audits, payment details, reports), contact numbers and e-mail addresses of employees and c ustomers, SSNs, family member information, incident with compensa tion reports, etc. |
||||||
| Ransomware | Mark Resolve Inc id16937 View details | United States | Services | — | pending | |
|
This organization primarily operates in the Business Consulting, nec business / industry within the Engineering, Accounting, Resea rch, and Management Services sector. We are ready to upload more than 13 GB of private corporate docum ents such as: driver licenses, internal financial documents, insi de corporate correspondence, customer contact emails and phones, etc |
||||||
| Ransomware | WorldNet Telecommunications LLC id16779 View details | Puerto Rico | Telecommunications | — | pending | |
|
WorldNet stands out for offering services to companies with a ful l range of technology solutions, including digital security, IT c onsulting, voice, data, cloud services, broadband Internet, satel lite telephony and business continuity. We are ready to upload more than 8 GB of private corporate docume nts such as: license agreements, NDAs, internal financial data (a udits, payment details, reports), insurance documents, customer c ontact emails and phones, etc. |
||||||
| Ransomware | Enghouse (ex. Navita) id16778 View details | Canada | Communication / Marketing | — | pending | |
|
Enghouse is a publicly traded Canadian company that provides ente rprise software solutions focused on remote work, visual computin g, and communications for next-generation software-defined networ ks. We are ready to upload some private corporate documents such as: internal financial data (audits, payment details, reports), emplo yee tax payer numbers, employee contact emails, etc. |
||||||
| Ransomware | Architects West id16764 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Architects West is a leading architecture firm based in Coeur dAl ene and Spokane, offering architectural, landscape architectural, and interior design services since 1973. We are ready to upload more than 120 GB of private corporate docu ments such as: HR documents, contact numbers and e-mail addresses of employees and customers, confidential agreements and contract s, financial data (audits, payment details, reports), etc. |
||||||
| Ransomware | Hayloft Property Management id16760 View details | United States | Communication / Marketing | — | pending | |
|
Hayloft Property Management Co. offers spacious, modern living, w here quality and comfort come first. Their apartments for rent ar e located in five states, with nine different communities: South Dakota, Iowa, Minnesota, Nebraska, and Kansas. We are ready to upload about 9 GB of private corporate documents such as: license agreements, contact numbers and e-mail addresses of employees and customers, SSNs, internal financial documents, incident reports, etc. |
||||||
| Ransomware | Divimast id16702 View details | Italy | Services | — | pending | |
|
Divimast is a business consulting company that brings together co nsultants who have been in the market for more than 20 years, hig hly specialized and ready to offer customized solutions for each client. We are ready to upload about 8 GB of private corporate documents such as: confidential agreements, internal financial documents, e mployee passports (identity cards), HR documents, contact numbers and e-mail addresses of employees and customers, etc. |
||||||
| Ransomware | VODOTEHNIKA D.D. id16701 View details | Croatia | Communication / Marketing | — | pending | |
|
Vodotehnika provides quality design, production and retail of hom e equipment and decor as well as support services. We are ready to upload some private corporate documents such as: internal financial documents, contact numbers and e-mail addresse s of employees and customers, passports (identity cards), etc. |
||||||
| Ransomware | Chain And Rope SuppliersLTD id16700 View details | Ireland | Communication / Marketing | — | pending | |
|
Started over 40 years ago, Chain And Rope Suppliers has grown from a specialist supplier of lifting equipment to Ireland's leading lifting controls and safety specia list. You will find some private corporate documents includin g: internal financial documents, contact numbers and e- mail addresses of employees and customers etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:DD954FADF10F9C810E0F9B6 E3BCB0832E8B244E1&dn=chainandrope.ie&tr=udp://tracker.o penbittorrent.com:80/announce&tr=udp://tracker.opentrac kr.org:1337/announce&tr=wss://wstracker.online |
||||||
| Ransomware | Beyond79 id16652 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Welcome Beyond79 is a community of committed jewelry professional s dedicated to the cultivation of passionate customers by deliver ing the ultimate online jewelry experience. We are ready to upload a lot of private documents such as: SSNs, contact numbers and e-mail addresses of employees and customers, internal financial documents, confidential correspondence, intern al financial documents, etc. |
||||||
| Ransomware | Moinho Globo Alimentos id16643 View details | Brazil | Public Sector | — | pending | |
|
Moinho Globo Alimentos is currently the fourth largest milling in dustry in the state, with an installed milling capacity of 12,500 tons/month. We are ready to upload more than 58 GB of private corporate docum ents such as: contact numbers and e-mail addresses of employees a nd customers, personal CNP/CPF/NIF, internal financial documents , etc. |
||||||