Ransomware Group intelligence

Avoslocker

Inactive

Track Avoslocker with 70 published victims and 2 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 70 Known published victims in this dataset

First discovered 2021-06-13 Earliest victim discovery date

Last discovered 2023-02-11 Latest victim discovery date

Inactive since 1347 days Days since the latest known victim

Top country United States 4 victims

Known locations 2 Leak or negotiation infrastructure tracked

Avoslocker is tracked by Breach House as a ransomware group with 70 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

Leaked 0 0.0%
Pending 70 100.0%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Down checked 5h ago	`avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion`
Leak location 1	Onion service	Down checked 5h ago	`avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion`

Communication / Marketing 13
Not identified 12
Finance / Legal / Insurance 10
Education 9
IT 4
Telecommunications 4
Manufacturing / Engineering 4
Healthcare / Pharma 3
Services 3
Construction / Real Estate 2
Transportation / Travel / Logistics 2
Public Sector 1
Energy 1
Retail / E-commerce 1
Hospitality / Food & Beverage / Tourism 1

Typical Attacks (15)

▼

How Avoslocker typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via AvosLocker.

T1106 Native API Execution

What they do: AvosLocker has used a variety of Windows API calls, including `NtCurrentPeb` and `GetLogicalDrives`.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1547.001 Registry Run Keys / Startup Folder PersistencePrivilege Escalation

What they do: AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode.

What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
T1027 Obfuscated Files or Information Stealth

What they do: AvosLocker has used XOR-encoded strings.

What that means: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
T1027.007 Dynamic API Resolution Stealth

What they do: AvosLocker has used obfuscated API calls that are retrieved by their checksums.

What that means: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis.
T1036.008 Masquerade File Type Stealth

What they do: AvosLocker has been disguised as a .jpg file.

What that means: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.
T1140 Deobfuscate/Decode Files or Information Stealth

What they do: AvosLocker has deobfuscated XOR-encoded strings.

What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
T1564.003 Hidden Window Stealth

What they do: AvosLocker has hidden its console window by using the `ShowWindow` API function.

What that means: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
T1688 Safe Mode Boot Defense Impairment

What they do: AvosLocker can restart a compromised machine in safe mode.

What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
T1057 Process Discovery Discovery

What they do: AvosLocker has discovered system processes by calling `RmGetList`.

What that means: Adversaries may attempt to get information about running processes on a system.
T1083 File and Directory Discovery Discovery

What they do: AvosLocker has searched for files and directories on a compromised network.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1124 System Time Discovery Discovery

What they do: AvosLocker has checked the system time before and after encryption.

What that means: An adversary may gather the system time and/or time zone settings from a local or remote system.
T1135 Network Share Discovery Discovery

What they do: AvosLocker has enumerated shared drives on a compromised network.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1486 Data Encrypted for Impact Impact

What they do: AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: AvosLocker has terminated specific processes before encryption.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1529 System Shutdown/Reboot Impact

What they do: AvosLocker’s Linux variant has terminated ESXi virtual machines.

What that means: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Tools Observed (23)

▼

Software Avoslocker has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

LaZagne Mimikatz XenArmor

Defense evasion

Avast Anti-Rootkit driver

Discovery & enumeration

NirSoft WinLister Nmap SoftPerfect NetScan

Exfiltration

FileZilla Gofile[.]io PSCP RClone share[.]riseup[.]net

LOLBAS (living-off-the-land binaries)

PsExec WMIC

Networking & tunnelling

Chisel Ligolo

Offensive security tooling

Cobalt Strike Sliver

Remote monitoring & management

AnyDesk Atera PDQ Deploy Splashtop TacticalRMM

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (2)

▼

$157,527 Received (USD)

3 Payments

2 Known wallets

$83,713 Largest single payment

2021-09-09 → 2021-09-09 Payment window

bitcoin · 2

Address	Chain	Received (USD)	Payments
`1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G`	bitcoin	$157,527	3
`136E7fWV1i6aZG3idMzQuhJiKqJj2oQ15M`	bitcoin	$0	0

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

avoslocker.txt txt · 998 chars

Attention!
Your files have been encrypted.
We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted.
In order to decrypt your files, you must pay for the decryption key & application.
You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion.
This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/
Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website.
Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly.
The corporations whom don't pay or fail to respond in a swift manner can be found in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion


Your ID: [snip]

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (70)

Search, filter and paginate the victim timeline for Avoslocker. Showing 1–70 of 70.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	Cambian Group id5405 View details	2023-02-11		IT	—	pending
Includes data from Care Tech Holdings PLC (parent holding company, caretech-uk.com) & ByTheBridge.co.uk & Cambian Group. A billion dollar mega-corporation and British orphans, what could go wrong? ID 5405
Ransomware	Memtech Acoustical id5404 View details	2023-02-11		IT	—	pending
Memtech Acoustical is your 'one-stop' source for acoustic services, noise control and acoustic material installation. There is no need to coordinate consultants, order materials and arrange for installation. Memtech does it all. Memtech Acoustical Industrial, Commercial, and Acoustic Noise Control Solutions ID 5404
Ransomware	Global Mining Products id5403 View details	2023-02-11	Indonesia	Communication / Marketing	—	pending
Global Mining's Product Catalog is available for download. MINExpo 2012 Please Visit Global Mining Products Inc at MINExpo 2012 Booth No. 9144 Service and Repair Facilities 3 Location To Serve You Better Global Mining - USA Ph: 775-778-3410 Fax: 775-778-3418 Global Mining - Canada Ph: 604-538-0058 Fax: 604-541-2850 PT GloMinPro Indonesia ID 5403
Ransomware	Buckeye Packaging id5402 View details	2023-02-11		Telecommunications	—	pending
Buckeye Packaging offers high-quality custom packaging solutions in a variety of substrates, delivered with outstanding customer service and terrible network security. 50 GB customer data will be released ID 5402
Ransomware	Wesco Turf id5401 View details	2023-02-11	United States	Communication / Marketing	—	pending
Finance, HR, Corporate files present in data leak We are an exclusive provider for Toro, Club Car, Bernhard, Salsco, Harper, Ventrac, and MCI-Flowtronex and Watertronics Pump Stations in Florida and Southern Georgia. Since 1987 Wesco Turf has been the golf, grounds, and irrigation market leader. We are a worldwide provider of the highest quality used golf course equipment. Wesco has been honored multiple times as Toro’s North American Distributor of Excellence. ID 5401
Ransomware	CannonDesign id5400 View details	2023-02-11		Public Sector	—	pending
Employees: 1,100 - Revenue: $279.8M - Site: www.cannondesign.com Exfiltrated: 5.7 TB Wasting our time will result in your data being leaked. Over 5 TB corporate and client files will be released CEO: "Entity": "US", "SSN - US": "367725265", "Last Name": "Lukanic", "First Name": "Bradley", "Nickname": "Brad", "Street Address": "6619 Braeburn Pkwy", "City": "Bethesda", "State/Prov": "MD", "Zip Code": "20817", "Birth Date": "02/15/1971", CFO: "Entity": "US", "SSN - US": "078564382", "Last Name": "Carlino", "First Name": "David", "Nickname": "Dave", "Street Address": "5411 Via Del Sole", "City": "Williamsville", "State/Prov": "NY", "Zip Code": "14221", "Birth Date": "07/29/1961", VP: "Entity": "US", "SSN - US": "121683252", "Last Name": "Schopp", "First Name": "Carolyn", "Nickname": "Carolyn", "Street Address": "3621 W River Road", "City": "Grand Island", "State/Prov": "NY", "Zip Code": "14072", "Birth Date": "10/09/1975", ID 5400
Ransomware	Schandy id5399 View details	2023-02-11		Other	—	pending
We have more than 100GB Data(Employers Data,CVs,Passports,HR,Confidential files...) ID 5399
Ransomware	Ultralife Corporation id5398 View details	2023-02-11	United States	Finance / Legal / Insurance	—	pending
Publicly traded stock as ULBI. Client information, design, manufacture, financial, accounting, HR and more. Address: 2000 Technology Pkwy, Newark, NY 14513, United States Phone: +1 315 332 7100 ID 5398
Ransomware	Hamilton Parker id5397 View details	2023-02-11		Other	—	pending
1865 LEONARD AVENUE COLUMBUS, OH 43219 614-358-7800 ID 5397
Ransomware	Corporate Interiors Inc id5211 View details	2023-01-07		Finance / Legal / Insurance	—	pending
Corporate Interiors - Steelcase office furniture - Delaware and Philadelphia Contact Us 1-800-690-9101 ID 5211
Ransomware	LW Group id5135 View details	2022-12-26		Telecommunications	—	pending
LW Group now represents eight (8) luxury automobile brands operating at nine (9) locations within the Boston, MA and New Hampshire markets. ID 5135
Ransomware	Keyano College id5134 View details	2022-12-26	Canada	Education	—	pending
Founded in 1965 and based in Fort McMurray, Canada, Keyano College is a community college meeting both the training and skills acquisition needs of industry. Headquarters: 8115 Franklin Ave, Fort McMurray, Alberta, T9H 2H7, Canada Phone Number: (780) 791-4800 ID 5134
Ransomware	McKenzie Health System id5133 View details	2022-12-26		Healthcare / Pharma	—	pending
McKenzie Health System (MHS) is a not-for-profit medical and surgical hospital in Sandusky, Mich., with nine clinics in the surrounding region. ID 5133
Ransomware	Avamere Family of Companies id5132 View details	2022-12-26		Healthcare / Pharma	—	pending
Founded in 1995 and headquartered in Wilsonville, Oregon, Avamere Family of Companies is a group of healthcare organizations and systems. ID 5132
Ransomware	Yildiz Entegre USA id5131 View details	2022-12-26		Finance / Legal / Insurance	—	pending
https://www.zoominfo.com/c/yldz-entegre/355492210 https://www.***.com/business-directory/company-profiles.yildizlar_yatirim_holding_anonim_sirketi.5db0188dbc06caa3c959161dce6ad867.html NEWS about ~$200,000,000 investments by Company: Yıldızlar Yatırım Holding. Source: https://www.enkocaeli.com/haber/9845649/yildizlar-yatirim-holdinge-saldiri-iddiasi We should provide Bank Investigations and refer to The Central Bank of the Republic of Turkey, Federal Reserve etc List of Holding's affiliated group companies: 1- İstanbul Gübre Sanayi Anonim Şirketi 2- Yıldız Entegre Ağaç San ve Tic AŞ, 3- İGSAŞ Tarımsal Ürünler AŞ, 4- İGSAŞ Sigorta ve Aracılık Hizmetleri AŞ, 5- Yıldız Demir Çelik Sanayi AŞ, 6- YLDZ Laboratuvar Hiz Tic AŞ, 7- Yıldızlar Deniz İşletmeciliği AŞ, 8- YYH Yıldız Enerji Tedarik ve Toptan Satış AŞ, 9- Yıldız Entegre USA INC., 10- Yıldız Entegre Romania SA, 11- Yıldız Chem SRL, 12- Yıldız Logistica SRL, 13- Yıldız Entegre Russia OOO, 14- Yıldız Entegre Adriya DOO This leak contains most of Strictly_Confidential files with file extensions: .doc / .xls / .xlsx / .pdf / .msg / etc ID 5131
Ransomware	CMHA National id5130 View details	2022-12-26		Services	—	pending
The Canadian Mental Health Association provides mental health services and support. The Association offers advocacy, education, research, and services to person... ID 5130
Ransomware	Chimbusco id5129 View details	2022-12-26	China	Energy	—	pending
Established in 1972, CHIMBUSCO has since reformed with two major shareholders namely, PetroChina and COSCO Group engaging in marine fuel supply of bunker oil, marine lubricants and fresh water as well as trading, blending, transportation and storage of oil products. CHIMBUSCO operates over 50 major ports and 30 branch offices in China, with an operational fleet of over 100 barges. ID 5129
Ransomware	LPA Design id5128 View details	2022-12-26		Communication / Marketing	—	pending
LPA Design is an electronics R&D consulting company with engineering expertise in printed circuit board design, RF communications and antenna optimization, and remote sensors. LPA Desing developed the PocketWizard™ line of photography products. ID 5128
Ransomware	Public Employees Credit Union id5127 View details	2022-12-26		Finance / Legal / Insurance	—	pending
We have confidential files belonging to all 29000 members including Name, Address, SSN, Telephone, Email, Credit Cards, Loan Applications, IRS Documents. Include small sample. ID 5127
Ransomware	TPI Corporation id5126 View details	2022-12-26		Communication / Marketing	—	pending
Data Stolen: ~1TB of confidential data were NDA-agreemtents, email-bases, private conversations .msg, financial statements, IRS, confidential business information, engineering projects, legal statements, accounting statements etc. We uploaded small size of Stolen data in TPI-Part1.zip archive for public review: 2022-03-31 TPI Financial STMTS.pdf 2021-08-30 IRS CP216F Notice.pdf 2021-03-31 Mutual NDA - Hearn TPIFostoria Corporation v1.0 (Executed).pdf 2021-03-31 Headliner NVH Project.msg 2020-07-10 Mission National Ins. Co, 2020 Distribution.pdf 2020-03-16 Oliver's of Oregon Bankruptcy.pdf 2019-02-22 ProcessHeat - Project Thermo Countersigned CA - TPI.pdf 2019-02-15 TPICorpFostoriaProcessEquipment&CustomPaperTubesouthwest-Mutual Non-disclosure Agreement.msg 2013-04-15 Federal Mogul Mutual Confidentiality Agreement.pdf 2012-12-21 Emitted Energy Corp Mutual Non-Disclosure Agreement.pdf Peter Wang Contact Info.pdf ID 5126
Ransomware	CHRISTUS Health id5125 View details	2022-12-26		Healthcare / Pharma	—	pending
Founded in 1999, CHRISTUS Health an international Catholic, faith-based, not-for-profit health system, is headquartered in the Dallas area. ID 5125
Ransomware	BLUME GLOBAL INC id5124 View details	2022-12-26		Communication / Marketing	—	pending
BLUME GLOBAL INC BLUME GLOBAL INDIA PRIVATE LTD BLUME GLOBAL HONG KONG LIMITED Data Stolen: Proprietary & Confidential, Strictly Confidential NDA agreemtents signed by DocuSign with: J.P. Morgan Securities LLC, Mitsui & Co (mitsui.com) Signatory Mariko Tsuchida(Deputy General Manager), Yara International ASA Signatory Loredana Nistor(IT Sourcing Manager), Dell Inc. Signatory Lisa Woo(Legal Counsel, Legal Strategy and Operations), Hewlett Packard Enterprise Company Signatory Kim Masone(VP Global Logistics Operations), Desarrollo Logístico, S.A., FAIRMOUNT PARTNERS, CITIGROUP GLOBAL MARKETS INC. Signatory Eric Burns(Managing Director), MARLIN MANAGEMENT COMPANY LLC Signatory Ryan Laurin(Managing Director), GI PARTNERS ACQUISITIONS LLC, LiveSource Inc., Röhlig blue-net GmbH, REZ1 Cisco NDA etc + email-bases, private conversations .msg, financial statement etc. We uploaded small size of Stolen data in Blumeglobal_Part1.zip archive. ID 5124
Ransomware	CPA Mutual Insurance Company id5123 View details	2022-12-26		Finance / Legal / Insurance	—	pending
Cyber Insurance policy leaked in sample. At CPA Mutual, our mission is to provide a quality and lasting solution to the professional liability needs of accountants. We bring added value to our member firms by continually striving to exceed their expectations and helping them manage and prevent risks. ID 5123
Ransomware	Livingston id5122 View details	2022-12-26		Services	—	pending
Livingston is a quality source for rental of all Test Equipment and Equipment Management Services with local offices in all major countries. ID 5122
Ransomware	CR2 id5121 View details	2022-12-26	Singapore	Finance / Legal / Insurance	—	pending
CR2 is an Irish-owned banking software company which provides mobile, internet and ATM financial service technology to more than 100 retail banks across Africa, the Middle East and Asia. Headquartered in Dublin, Ireland, the company has offices in Dubai, London, Cairo, Amman, Bengaluru, Lagos, Johannesburg, Singapore and Perth. Its customers include ANZ, Barclays, Standard Chartered, Botswana Savings Bank, Jordanian Bank al Etihad,pan-African bank Orabank, and Nigeria’s Access Bank plc and Diamond Bank. 500 GB+ Data includes: - Sources to all products ever developed including BankWorld, BankWorld POS & ATM. - Financials - HR documents - Accounting files - Sensitive information on more than 100 banks worldwide Sample includes the compressed 500 MB large file list and a couple random files for proof, shareholders e-mail list, all active directory users with their names, titles, phone numbers, and e-mails. (28.8 MB compressed) ID 5121
Ransomware	Bechstein id5120 View details	2022-12-26	Germany	Communication / Marketing	—	pending
Top quality since 1853: the C. Bechstein name is synonymous with exquisite grand and upright pianos made in Germany. ID 5120
Ransomware	Montmorency College id5119 View details	2022-12-26		Education	—	pending
Cyberattack at Collège Montmorency: ~8TB personal data has been compromised by AVOSLOCKER. Board of Directors should contact with us immediately to avoid the full leak on our blog. News and facts about Cyberattack: https://www.lapresse.ca/actualites/education/2022-05-21/cyberattaque-au-college-montmorency/la-direction-evoque-un-possible-vol-de-donnees-personnelles.php https://thecanadian.news/cyberattack-at-college-montmorency-personal-data-has-been-compromised/ https://www.academica.ca/top-ten/cyberattacks-strike-coll%C3%A8ge-montmorency-us-institution https://oicanadian.com/college-montmorency-victim-of-an-alleged-cyberattack/ https://www.spamchronicles.com/college-montmorency-victim-of-a-cyber-attack/ https://actualnewsmagazine.com/english/cyberattack-at-montmorency-college-the-management-evokes-a-possible-theft-of-personal-data/ ID 5119
Ransomware	Transform Data Into Insight id5118 View details	2022-12-26		Other	—	pending
More Than 50GB Important DATA Stolen Will be Publish ID 5118
Ransomware	Garnica Plywood id5117 View details	2022-12-26		Communication / Marketing	—	pending
WILL LEAK ALL DATA SEPTEMBER 1, SAMPLE INCLUDE CONTACT At Garnica, we offer a wide range of plantation species; we boast different kinds of wood for construction, mobility, furniture, DIY projects and much more. Discover them here. Architecture and materials 21-07-2022 How is plywood manufactured step by step Our commitment to excellence in the plywood production process is reflected in each step. ID 5117
Ransomware	Casa International id5116 View details	2022-12-26		Retail / E-commerce	—	pending
European furniture retailer operating in multiple countries ID 5116
Ransomware	WBSCHOOLS id5115 View details	2022-12-26		Education	—	pending
Employee info leak ID 5115
Ransomware	Los Alamos Nature Center id5114 View details	2022-12-26		Finance / Legal / Insurance	—	pending
As a financial cooperative, Los Alamos Schools Credit Union provides financial products and services to members featuring more attractive rates and... All data will be leaked in the next post update. ID 5114
Ransomware	Mount Vernon Mills id5113 View details	2022-12-26		Manufacturing / Engineering	—	pending
stablished in 1947 and headquartered in Mauldin, South Carolina, Mount Vernon Mills is a textiles manufacturer, producing chemicals, textiles, and... ID 5113
Ransomware	Khoemacau Copper Mining id5112 View details	2022-12-26	Botswana	Communication / Marketing	—	pending
ALL Active Directory domain hashes leaked!!! Format: kcm.local\tshiamo.molefe:::13506d75610047a00e0b7692e81f70b2::: kcm.local\mpho.losike:::923a3103e0e13ab8014c9a8354c6337f::: kcm.local\roy.basson:::27f0e2227d44e6b2ac122c25350efd4c::: kcm.local\marius.ungerer:::ba1a5281df2eba76948e8c68aaa9211c::: kcm.local\helga.hugo:::c67c2209034b9537cc07083d842e9f65::: kcm.local\FortiEMS-svc:::975020171cada4be8e8fb655fcf49e4f::: kcm.local\tobokani.mosetlha:::0f9437d2c04e53cf4930a1b7cd50659a::: kcm.local\nikiwe.mahlasela:::83bcee313b6b3bb5d5cd1434128c92e6::: kcm.local\mooketsi.rantape:::e9923a513a6ee1fb4e08251da13993b2::: kcm.local\kuairani.hengari:::3ff04097c34204839ec416b3c1399b8b::: The Khoemacau copper project is an underground mine being developed by American private equity firm Cupric Canyon Capital's subsidiary Khoemacau Copper Mining in Botswana. Khoemacau Copper signed a $565m project funding package deal with Cupric Canyon Capital for the development of the high-grade Khoemacau copper project in February 2019. ID 5112
Ransomware	The Brigantine id5111 View details	2022-12-26		Hospitality / Food & Beverage / Tourism	—	pending
The Brigantine Restaurants are a San Diego favorite for fresh seafood, steaks and chops, friendly and knowledgeable services, and inviting facilities. ID 5111
Ransomware	SCAD EDU id5110 View details	2022-12-26	United States	Education	—	pending
1 database, filelist, all email/phone leaked in sample! Everything leak in 2 week Savannah College of Art and Design (SCAD) is a private nonprofit art school with locations in Savannah, Georgia; Atlanta, Georgia; and Lacoste, France. Founded in 1978 to provide degrees in programs not yet offered in the southeast of the United States, the university now operates two locations in Georgia, a degree-granting online education program, and a study abroad location in Lacoste, France. The university enrolls more than 14,000 students from across the United States and around the world with international students comprising up to 17 percent of the student population.[3] SCAD is accredited by the Southern Association of Colleges and Schools Commission on Colleges and other professional accrediting bodies. ID 5110
Ransomware	Truckslogic id5109 View details	2022-12-26	Guatemala	Finance / Legal / Insurance	—	pending
Documents include Legal, Financials, passports, licenses Truckslogic Optimiza la logística de tu empresa. Queremos hacer tu vida y la de tu empresa más fácil, ofrecemos un servicio personalizado, flexible y con la experiencia de más de 15 años en el mercado. Colombia Carrera 12A #78-35, Piso 2, Bogotá. República Dominicana Calle Euclides Morillo 58, Diamond Mall - Local 81. Santo Domingo Guatemala Calzada Roosevelt 51-25, Ciudad de Guatemala. CP: 01057 Panamá International Business Park Edificio 3825. local 107, planta baja Panamá Pacífico ID 5109
Ransomware	TeladanPrima Argo Group id5108 View details	2022-12-26		Communication / Marketing	—	pending
750GB+ of stolen data include contracts, confidential , intellectual property data, and more ID 5108
Ransomware	Sunland Asphalt And Construction id5107 View details	2022-12-26		Construction / Real Estate	—	pending
Human Resources, Projects, Documents, and more. If Sunland Asphalt refuses to pay the ransom, every data will be published to the public. ID 5107
Ransomware	Stratford University id5106 View details	2022-12-26		Education	—	pending
samples of: Confidential agreements Military personnel (white house service members) related files taxation data ID 5106
Ransomware	Xybion id5105 View details	2022-12-26		Communication / Marketing	—	pending
Xybion's Emidence TM platform satisfies our current and evolving future needs with the unique adoption technique of "Your Process - Your Way", Joseph F. Molloy Vice President, Workforce Safety. We wanted to go paperless without impacting our existing business processes. It was a smooth transition for our users thanks to Labwise XD. ID 5105
Ransomware	Our Lady of Lake University id5104 View details	2022-12-26		Education	—	pending
Our Lady of the Lake University, founded in 1895 by the Congregation of Divine Providence, is a coeducational institution. - DB - Health - Finance - Admissions - IT - HR And many of more... ID 5104
Ransomware	Paul Smiths College id5103 View details	2022-12-26		Education	—	pending
At Paul Smith's College, it's about the experience. We are the only four-year institution offering broad-based higher education in the Adirondacks. Our programs... ID 5103
Ransomware	Northwest University id5102 View details	2022-12-26		Education	—	pending
Confidential, taxation, and financial data ID 5102
Ransomware	Emtec Inc id5101 View details	2022-12-26		Telecommunications	—	pending
Global IT company with terrible IT security. How can Emtec secure clients when they don't secure their own network? MISRA SUNIL SSN:050-66-2655 Email:[email protected] JOHNSON RICK SSN:252-33-1704 Email:[email protected] DESAI DINESH SSN:516-74-2061 Email:[email protected] CHANDLER GREGORY SSN:220-02-8854 Email:[email protected] BALLINGER VICKI SSN:208-46-9296 Email:[email protected] ID 5101
Ransomware	American International Industry id5100 View details	2022-12-26		Communication / Marketing	—	pending
The leading manufacturer and distributor of innovative, quality beauty and skin care products for men and women. With 45 years of industry experience.The leading manufacturer and distributor of innovative, quality beauty and skin care products for men and women. With 45 years of industry experience. ID 5100
Ransomware	Zeus Scientific Inc id5099 View details	2022-12-26		Services	—	pending
https://www.zeusscientific.com/about Zeus Scientific, Inc. manufactures clinical diagnostic solutions. The Company offers flexible solutions for autoimmune and infectious disease testing. AvosLocker team publishes the first part of exfiltrated files from Zeus Scientific Servers, NDA contracts etc ID 5099
Ransomware	Hughes Systems Industrial id5098 View details	2022-12-26		Manufacturing / Engineering	—	pending
All company projects includes drawings, contracts, and all details employees social security number 401K plans company financial data includes bank accounts information, and taxation reports and more ID 5098
Ransomware	DLS Motors id5097 View details	2022-12-26	Paraguay	Communication / Marketing	—	pending
We downloaded 50GB of internal files from DLS Motors. -- Just 83 years ago, the company Sobera S.A. entered the Paraguayan market, bringing new business opportunities, new projects, new sources of employment and contributing to the sustained economic growth of our country. ID 5097
Ransomware	Cosmopoint College id5096 View details	2022-12-26		Education	—	pending
We downloaded about 80 gigabytes of internal school documents, including teacher and student contact information, student loan contracts, internal school financial documents, etc ID 5096
Ransomware	ALVAC SA id5095 View details	2022-12-26		Telecommunications	—	pending
Website - https://alvac.es Company name: ALVAC S.A. Companies System Administrator trying to hide the cyberattack on the ALVAC S.A. servers. Vídeos confidenciales https://vimeo.com/752214614 AvosLocker team is ready to leak more files on the blog, publish video-files and attack networks again. We should agree with you to decrypt your networks and remove all ALVAC S.A. exfiltrated files from AvosLocker team servers. https://twitter.com/PedroFe12181764/status/1575117531957846017 https://twitter.com/search?q=%40alvac&src=typed_query&f=live ID 5095
Ransomware	Memory Express id1464 View details	2021-09-26		Communication / Marketing	—	pending
No additional victim description available. ID 1464
Ransomware	Huali Industrial Group id1461 View details	2021-09-25		Manufacturing / Engineering	—	pending
No additional victim description available. ID 1461
Ransomware	Whitefish River First Nation id1460 View details	2021-09-25		Other	—	pending
No additional victim description available. ID 1460
Ransomware	Unified Technologies id1459 View details	2021-09-25		IT	—	pending
No additional victim description available. ID 1459
Ransomware	Amphenol Canada id1458 View details	2021-09-25		Other	—	pending
No additional victim description available. ID 1458
Ransomware	Pacific City Bank id687 View details	2021-09-04		Finance / Legal / Insurance	—	pending
No additional victim description available. ID 687
Ransomware	Moorfields NHS UK & Dubai id685 View details	2021-09-01		Other	—	pending
No additional victim description available. ID 685
Ransomware	Potter Concrete id686 View details	2021-09-01		Other	—	pending
No additional victim description available. ID 686
Ransomware	Master Chemical id683 View details	2021-08-29		Manufacturing / Engineering	—	pending
No additional victim description available. ID 683
Ransomware	Artas Holding / Artas Insaat id679 View details	2021-08-28		Other	—	pending
No additional victim description available. ID 679
Ransomware	Coghlin Electrical Contractors id680 View details	2021-08-28		Construction / Real Estate	—	pending
No additional victim description available. ID 680
Ransomware	Home in Brussels id681 View details	2021-08-28		Other	—	pending
No additional victim description available. ID 681
Ransomware	On logistics Services Algeciras, S.L id682 View details	2021-08-28		Transportation / Travel / Logistics	—	pending
No additional victim description available. ID 682
Ransomware	Gimmler Gruppe id675 View details	2021-08-19		Other	—	pending
No additional victim description available. ID 675
Ransomware	SoftwareDesign Consulting Group id676 View details	2021-08-19	United States	IT	—	pending
No additional victim description available. ID 676
Ransomware	Mauck & Baker id671 View details	2021-08-05		Other	—	pending
No additional victim description available. ID 671
Ransomware	Geneva, Ohio id656 View details	2021-06-18		Other	—	pending
No additional victim description available. ID 656
Ransomware	Heller Injury Lawyers id653 View details	2021-06-13		Finance / Legal / Insurance	—	pending
No additional victim description available. ID 653
Ransomware	Arabian Cargo Group id654 View details	2021-06-13		Transportation / Travel / Logistics	—	pending
No additional victim description available. ID 654