Ransomware Group intelligence
Cheers
InactiveTrack Cheers with 15 published victims and 2 known leak locations in a single intelligence view.
Overview
Cheers is tracked by Breach House as a ransomware group with 15 published victims.
The group is tracked across multiple victim records in the Breach House dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | rwiajgajdr4kzlnrj5zwebbukpcbrjhupjmk6gufxv6tg7myx34iocad.onion |
| Leak location 2 | Onion service | Unknown | crkfkmrh4qzbddfrl2axnkvjp5tgwx73d7lq4oycsfxc7pfgbfhtfiid.onion |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (15)
Search, filter and paginate the victim timeline for Cheers.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | DYNAM JAPAN HOLDINGS CO., LTD id4168 View details | Services | — | ||
|
DYNAM JAPAN HOLDINGS CO., LTD is a Japan-based services company and investment holding company headquartered in Tokyo. It operates pachinko and pachislot halls, described as one of Japan’s largest pachinko chains, and also offers related services such as insurance, cleaning, food and drink, real estate, and aircraft leasing. The company’s business profile centers on amusement hall operations and supporting services in Japan. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An Japan Game Halls Operator id4069 View details | Other | — | ||
|
An Japan Game Halls Operator is a Japan-based company in the broader other sector, operating game halls and related leisure entertainment services for local customers. Its business is associated with venue-based gaming and amusement activities, which places it within Japan’s consumer entertainment market. In threat-intelligence catalogs, it is recorded as a ransomware-victim listing tied to the Cheers group. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An British Financial Company -Public id3964 View details | Finance / Legal / Insurance | — | ||
|
An British Financial Company -Public is a publicly listed entity identified in threat-intelligence sources as operating in the finance, legal, or insurance space in the United Kingdom. Companies in this sector typically provide financial services, advisory support, or related administrative functions to clients and institutions. In this catalog, the name is preserved as reported by the source record rather than expanded into unverified corporate details. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An Insurance Company -Paid id3936 View details | Finance / Legal / Insurance | — | ||
|
An Insurance Company - Paid is an insurance-sector organization in the Finance, Legal, and Insurance field, based in the United States. Insurance companies provide risk-transfer products and related services that help businesses and individuals manage financial exposure, claims, and coverage needs. Public ransomware-tracking records identify it as a victim entry rather than a verified breach disclosure. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An Turkey Certified Public Accountancy Firms -Unpay id3935 View details | Public Sector | — | ||
|
Turkey Certified Public Accountancy Firms -Unpay operates within the Public Sector in Turkey, providing certified public accountancy services to enterprises and business concerns. These firms deliver essential offerings including tax advisory and filing, bookkeeping, financial reporting, payroll compliance, company setup, audit services, and strategic financial planning under Turkish law. The profession is regulated by Professional Law No. 3568 on Certified Public Accountancy, with oversight by the Public Oversight, Accounting and Auditing Standards Authority (KGK). Turkey Certified Public Accountancy Firms -Unpay was listed as a ransomware victim associated with the threat actor cheers. |
|||||
| Ransomware | An Insurance Company id3825 View details | Finance / Legal / Insurance | — | ||
|
An Insurance Company is an insurer in the Finance, Legal, and Insurance sector, a business category that provides financial protection against risks in exchange for premium payments. Insurance companies operate under federal and state regulatory and reporting requirements, and their offerings typically center on underwriting, policy administration, claims handling, and risk transfer. In a threat-intelligence index, the entity is recorded as an insurance-sector organization in the United States. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An British Financial Company -Unpay id3807 View details | Finance / Legal / Insurance | — | ||
|
An British Financial Company -Unpay is a United Kingdom-based enterprise operating within the Finance, Legal, and Insurance sectors, providing financial services and related advisory offerings to clients across the region. The company functions as a key participant in the British financial ecosystem, delivering specialized products and support tailored to the needs of businesses and individuals in the finance and legal domains. It was listed as a ransomware victim associated with the threat actor cheers. |
|||||
| Ransomware | An International Shipping Company - Paid id3806 View details | Transportation / Travel / Logistics | — | ||
|
An International Shipping Company - Paid is an entity in the Transportation / Travel / Logistics sector, operating in shipping and freight movement. The name suggests a company involved in international cargo transport or related logistics services, likely serving cross-border trade and supply chains. In threat-intelligence indexes, it is cataloged as a ransomware victim record. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An International Shipping Company - Unpay id3705 View details | Transportation / Travel / Logistics | — | ||
|
An International Shipping Company - Unpay operates in the Transportation, Travel, and Logistics sector, managing the movement of goods across trucking, rail, ocean, and air networks. The company provides end-to-end freight lifecycle services including planning, execution, tracking, communication, and exception management. It functions as a transportation provider that moves freight, manages carriers, and coordinates modes to support global supply chain operations. An International Shipping Company - Unpay was listed as a ransomware victim associated with the threat actor cheers. |
|||||
| Ransomware | https:// id3703 View details | Other | — | ||
|
Dynam Japan Holdings Co., Ltd is a Japanese company operating in the Other sector, primarily engaged in investment and financial services with no specific geographic location beyond Japan. The firm offers diversified investment solutions and financial management services to clients across the country. It was listed as a ransomware victim associated with the Cheers threat actor, which targets VMware ESXi servers using Linux-based malware. The incident involved double-extortion tactics without confirmed data theft or record counts. No official breach notification date from the company itself has been publicly disclosed. |
|||||
| Ransomware | Sembcorp Marine - Unpay id3695 View details | Services | — | ||
|
Sembcorp Marine is a Singapore-based services company in the offshore and marine industry, known for shipbuilding, rig construction, repair, and related engineering work. It has been positioned around offshore renewables, new energy, and cleaner solutions as the sector has evolved. The company operates from Singapore and serves maritime and energy customers across complex industrial projects. Sembcorp Marine - Unpay was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An Technology Company - Paid id3554 View details | IT | — | ||
|
An Technology Company - Paid is an IT-sector company in Australia, operating in information technology and related services. Publicly available search results do not provide a reliable official company profile, so its location and offerings beyond that sector-level identification are not confirmed. In threat-intelligence indexing, it appears as a named entity used to track ransomware-related exposure and attribution context. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An Financial Company - Paid id3553 View details | Finance / Legal / Insurance | — | ||
|
An Financial Company - Paid is a financial-services organization in the Finance, Legal, and Insurance space, a sector that includes providers of lending, insurance, and related risk-management services. In the United States, premium finance companies are a regulated class of financial businesses that help customers fund insurance premiums, and financial-services firms often also support legal and insurance operations. The listing appears in a threat-intelligence context rather than as a public corporate profile. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An Belgium Hospital - Unpay id3552 View details | Healthcare / Pharma | — | ||
|
An Belgium Hospital - Unpay appears as a Belgium-based healthcare and pharma entity in a hospital context, indicating activity centered on patient care and related medical services in Belgium. Public reporting on Belgian hospitals in ransomware incidents describes operational disruption, including cancelled surgeries and staff payment issues, underscoring the sector’s exposure to cyber risk. The listing reflects a healthcare organization rather than a cyber actor, and its name suggests an unpaid account or billing-related label used in threat-intelligence indexing. It was listed as a ransomware victim associated with cheers. |
|||||
| Ransomware | An International Maritime Company - Unpay id3551 View details | Services | — | ||
|
An International Maritime Company - Unpay is a Services-sector maritime business associated with maritime operations and seaborne commerce in Panama. International maritime companies typically provide shipping, vessel, crew, logistics, or related support services to keep trade moving across ports and routes. The name suggests a company operating in the maritime services space rather than a manufacturer or retailer. It was listed as a ransomware victim associated with cheers. |
|||||