Ransomware Group intelligence
Cyclops
InactiveTrack Cyclops with 7 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Cyclops is tracked by Breach House as a ransomware group with 7 published victims.
Australia is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Down checked 1h ago | knight3xppu263m7g4ag3xlit2qxpryjwueobh7vjdc3zrscqlfu3pqd.onion |
| Leak location 1 | Onion service | Down checked 1h ago | nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onion |
Top Activity Sectors (4)
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Cyclops, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
What they do: Cyclops exploits domain accounts for privilege escalation and persistence across targeted IT and telecommunications environments.
What that means: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
-
T1059.001 PowerShell Execution
What they do: Cyclops uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across targeted systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1106 Native API Execution
What they do: Cyclops leverages native API calls to interact with system functions for execution and evasion during initial compromise.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Cyclops disables security tools and monitoring agents using T1685 techniques to hinder incident response efforts.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.013 Encrypted/Encoded File Stealth
What they do: Cyclops encrypts victim files using encoded formats to ensure impact and prevent data recovery.
What that means: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection.
-
T1110 Brute Force Credential Access
What they do: Cyclops uses brute force attacks against local accounts to gain initial access to victim networks.
What that means: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
-
T1057 Process Discovery Discovery
What they do: Cyclops performs process discovery to identify critical system processes and services for targeted disruption.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Cyclops exploits SMB/Windows Admin Shares for lateral movement between systems within compromised networks.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: Cyclops exfiltrates sensitive data via C2 channels to enhance leverage during ransomware extortion demands.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: Cyclops encrypts victim files with impact-oriented algorithms to maximize disruption across communication and healthcare sectors.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Cyclops stops critical services using command execution to disable operational systems before encryption.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Cyclops executes system recovery inhibition commands to prevent backup restoration and increase ransomware pressure.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (7)
Search, filter and paginate the victim timeline for Cyclops. Showing 1–7 of 7.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | important information（Knight） id7939 View details | Communication / Marketing | — | ||
|
We are about to close the old panel and blog and in version 2. 0 we renamed it Knight. We are releasing the new panel and program this week.We are still recruiting new teams, but you must have enough experience. We have a major update in version 2.0 and our only contact TOX：9096AD7062A4232F5AA31C2F7C4DF0AC1EAD10B78D40A6A3328AD142A42B555E635954D8B6C5 |
|||||
| Ransomware | Pechexport id7417 View details | China | Communication / Marketing | — | |
|
Infrastructure and logistics Pêchexport is located in Majunga on a surface of 8400 m². Our premises include offices, a factory, a laboratory, storage equipment and technical workshops. We have a fleet of eight freezer trawlers, two refrigerated trucks and a fleet of vehicles transporting our products upstream.Hygiene and quality We have eight EU and CIQ (The China entry-exit Inspection and Quarantine Bureau) certified refrigerated trawlers. We have a CE-approved fish processing plant, with its HACCP (Hazard Analysis Critical Control Point) approach, a treatment capacity of 5t/day and a cold store that can store up to 300 tons. We have our own bacteriological and physico-chemical analysis laboratory approved by the Institut Pasteur. All our products are systematically tested before each shipment to guarantee the best quality to our customers.Autonomous customs procedures To facilitate the export of our products, we carry out customs procedures ourselves through our transit service autonomously and efficiently.Data:======https://anonfiles.com/d9Iemaz3z4/VISA_ziphttps://anonfiles.com/VeD7i5z8za/SUIVI_2023_ziphttps://anonfiles.com/V6Lei3zdz1/PERSONNEL_ziphttps://anonfiles.com/edN3ibzazb/PROGRAMME_ETABLIR_ETAT_IR_POISSON_ziphttps://anonfiles.com/s2Qci9z0z3/ARMEMENT_zip |
|||||
| Ransomware | Cvlan id7416 View details | Italy | IT | — | |
|
Cvlan( Srl is a company that operates in the Information Technology and Services industry. It employs 21-50 people and has $5M-$10M of revenue.Site:========www.cvlan.itData:========https://anonfiles.com/q659Yeyczb/lift_me_zip |
|||||
| Ransomware | Superloop ISP id7300 View details | Australia | Telecommunications | — | |
|
Superloop is Australia’s modern challenger telco and internet service provider that’s unleashing the unlimited possibilities of the internet. Superloop is all about experience - we're not just a utility - with a promise to be super from the ground up. We’re more tech than telco, and we deliver quality service across our consumer, business, and wholesale units.Our can-do culture will excite and ignite our customers as we deploy game-changing solutions that solve customer pain points, backed by great customer service delivered by our highly enthused team of Superloopers, who are committed to making the internet experience super. Website: ======== https://superloop.com Data: ======= http://sbibb5lw7p2sedmm3pwifopsx7ky3klxqisjbl5awgze5dk2ueuc2qqd.onion/lift_me-6.zip PASSWORD:693OK@&iCW8PYmxoE7R6TaMg9OfN29Ae http://sbibb5lw7p2sedmm3pwifopsx7ky3klxqisjbl5awgze5dk2ueuc2qqd.onion/zip file name-4.zip PASSWORD:PrNi@7L66T3x@HONyMlpa4R3Qq70jz6c https://bayfiles.com/J4qdZ0x3za PASSWORD:1$q0dz4@h*Q&I$$@igkwELCP3NDR2$dt https://bayfiles.com/J4L6Y5x2zc PASSWORD:qx6uTel$O2lLGZGeUU0yNfiEy6eh%lpU |
|||||
| Ransomware | Guatemala Military Intelligence Directorate id7099 View details | Guatemala | Communication / Marketing | — | |
|
The Guatemalan Armed Forces (Fuerzas Armadas de Guatemala) consists of the National Army of Guatemala (Ejercito Nacional de Guatemala, ENG), the Guatemalan National Defense Navy (Marina de la Defensa Nacional, includes Marines), the Guatemalan Air Force (Fuerza Aerea Guatemalteca, FAG), and the Presidential Honor Guard (Guardia de Honor Presidencial).The Ministry of National Defence is the agency of the Guatemalan government responsible for the budget, training and policy of the armed forces. Based in Guatemala City, the Defence Ministry is heavily guarded, and the President of Guatemala frequently visits. As of 2017 the Minister of National Defence is Major General Luis Miguel Ralda Moreno.The Minister of Defense is responsible for policy. Day-to-day operations are the responsibility of the military chief of staff and the national defense staff.Data:===========https://anonfiles.com/F9pbi8zdzb/diemdn_mil_gt_zip |
|||||
| Ransomware | ALTARGRUP id7098 View details | Communication / Marketing | — | ||
|
Within the roof of Altar Group, the foundations of which were laid in 2012; We operate in 6 different areas: mobile phone insurance, renewal center, domestic and foreign trade, agriculture animal husbandry, software and consultancy. As Altar Group, our corporate strategy is to expand the knowledge and experience we have gained in all areas in which we operate and to carry out studies that will benefit the environment and society. In this direction, with our team of versatile professionals, we continue to work to carry forward all the sectors we are in with a service understanding based on quality and trust in national and international dimensions.We carry out damage assessment and repair activities with the insurance service we provide to the leading companies in the electronic devices sector. In this context, we offer repair and service packages that best meet the needs and demands of consumers for devices such as smartphones and tablets, which have become one of the needs of daily life. While carrying out all these activities, our priority is to provide and maintain customer satisfaction by providing high quality and fast service. With Novo Mobil, our Ministry of Commerce approved renewal center, we examine second-hand devices with precision and perform all necessary cleaning and parts replacement processes and offer the best quality devices back to use. Thanks to this sustainable business model, we both extend the hardware life of the devices and contribute to the reduction of technological waste.We are constantly working, developing and developing with our expert team with a focus on carrying forward the expertise and knowledge we have gained since the day we were established at every stage and producing innovative projects using this information. In this process, by accurately analyzing customer demands and the needs of the market, we make our strategic planning in the best way and carry out the processes in a controlled manner. With the business intelligence software we have developed in order to make process management in the best and simplest way, we offer solutions to the market to facilitate cumbersome management and business follow-up processes. In the light of all the experiences we have gained, we offer project consultancy services with all our transparency to the companies that request it in order to gain a place in the market and to take the right steps.When we analyze the needs of the national market, we can clearly see that technological studies and investments in the field of Agriculture and Livestock are at the initial level and that the awareness of Agriculture 4.0 has not yet been established in our society. In this context, with our internet of things based device and software solutions we have developed, our studies that will increase productivity by offering the right methods and tools in both agricultural production and livestock care are in the project development and testing phase. We continue to contribute to growth and social economy by transforming all the projects we develop and carry out into services and products on a national and international scale. |
|||||
| Ransomware | Atherfield Medical Service id7097 View details | Australia | Healthcare / Pharma | — | |
|
Hospitals & Physicians Clinics · AustraliaAtherfield Medical Service has been providing health care in the Yass region for over 100 years. They are an accredited general practice.Data:===========https://anonfiles.com/E5o3h8z2z4/Atherfield_Medical_and_Skin_Cancer_Clinic_Data_zip |
|||||