Ransomware Group intelligence
Ddosecret
ActiveTrack Ddosecret with 585 published victims and 4 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Ddosecret is tracked by Breach House as a ransomware group with 585 published victims.
Russian Federation is currently the most targeted country in this dataset.
4 known leak locations are currently associated with this group.
Leak Status Distribution
323
- Leaked 323 100.0%
- Pending 0 0.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (4)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 4 | Web location | Up checked 4h ago | data.ddosecrets.org |
| Leak location 3 | Web location | Up checked 4h ago | ddosecrets.org |
| Leak location 2 | Web location | Down checked 4h ago | ddosecrets.com |
| Leak location 1 | Web location | Down checked 4h ago | https://data.ddosecrets.com/ |
Top Activity Sectors (15)
- Not identified 231
- Public Sector 18
- Communication / Marketing 14
- Services 11
- Finance / Legal / Insurance 10
- Energy 7
- Telecommunications 3
- Manufacturing / Engineering 3
- IT 3
- Education 3
- NGOs / Associations 3
- Retail / E-commerce 2
- Hospitality / Food & Beverage / Tourism 1
- Transportation / Travel / Logistics 1
- Construction / Real Estate 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Ddosecret, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: ddosecret uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: ddosecret modifies Windows Registry Run keys to ensure ransomware execution upon system reboot.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: ddosecret disables antivirus tools and security software to prevent detection and hinder system recovery efforts.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: ddosecret deletes Volume Shadow Copies and backup files to eliminate recovery options for victims.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: ddosecret performs remote system discovery to map the victim network and identify high-value targets.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: ddosecret scans network shares to identify victim file structures and target directories for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: ddosecret exploits SMB/Windows Admin Shares to move laterally between networked victim machines.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: ddosecret exfiltrates victim data via encrypted C2 channels before demanding payment for decryption keys.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: ddosecret encrypts victim files using custom ransomware binaries, locking data for extortion demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: ddosecret invokes system recovery inhibition commands to prevent automatic restoration from backups.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (585)
Search, filter and paginate the victim timeline for Ddosecret. Showing 1–100 of 585.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | MyComplianceOffice idxyh44RaGLLaI View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Flock ALPR camera iddNtWHFj5sOSm View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Flock ALPR camera iddNtWHFj5sOSm View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Bauman Moscow State Technical University idFZUcgKnUi2qp View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Andrew Tate War Room Library idJRDtByXWlS9r View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Madison Square Garden idghYNncQSWzOC View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Madison Square Garden idghYNncQSWzOC View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Andrew Tate intelligence courses id3vf3RH567Glw View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Andrew Tate intelligence courses id3vf3RH567Glw View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | A growing threat the anti rights movement in the UK ideXaoqhihyv1r View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | A growing threat the anti rights movement in the UK ideXaoqhihyv1r View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Suno AI source idNvacO0MbuQVE View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | My Pillow idVUtx14wOBLFx View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Censored Amnesty International UK report id2FsAbtzWQrEW View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Censored Amnesty International UK report id2FsAbtzWQrEW View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Ashley Madison idJVmyA2fPN8Kv View details | — | leaked | |||
|
No additional victim description available. |
||||||
| Ransomware | Andrew Tate's War Room courses id4fe9506b8a25 View details | — | leaked | |||
|
Andrew Tate's War Room is an exclusive, all-male networking group based in Romania, where members pay approximately $8,000 per year to attend in-person meetings, dinners, and events. The program describes itself as promoting self-discipline, motivation, and confidence, though it has been documented instructing members to manipulate and isolate women for online sex work. It operates as a private mastermind with over 2,000 members, including hundreds of millionaires, organized into group chats covering topics like wealth generation and social media growth. This War Room has been linked to numerous allegations of abuse and trafficking, with the BBC identifying more than 40 women allegedly groomed by its members. The entity was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Andrew Tate's War Room courses id4fe9506b8a25 View details | — | leaked | |||
|
Andrew Tate's War Room is an exclusive, all-male networking group based in Romania, where members pay approximately $8,000 per year to attend in-person meetings, dinners, and events. The program describes itself as promoting self-discipline, motivation, and confidence, though it has been documented instructing members to manipulate and isolate women for online sex work. It operates as a private mastermind with over 2,000 members, including hundreds of millionaires, organized into group chats covering topics like wealth generation and social media growth. This War Room has been linked to numerous allegations of abuse and trafficking, with the BBC identifying more than 40 women allegedly groomed by its members. The entity was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | PT Bukit Asam Tbk id61470b10a41a View details | Other | leaked | |||
|
PT Bukit Asam Tbk is an Indonesian mining company headquartered in Tanjung Enim, South Sumatra, with additional corporate presence in Palembang and Jakarta. Its business centers on coal mining and related activities, with company profiles also describing broader energy and mining roles. The firm is publicly listed and operates as a state-owned enterprise in Indonesia’s coal sector. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Eurasian Patent Organization idd5b93c627d8c View details | Other | leaked | |||
|
The Eurasian Patent Organization is an intergovernmental body based in Moscow, Russian Federation, that administers the Eurasian patent system for inventions and industrial designs. It provides a single regional filing and examination framework that can lead to patent protection across the contracting states of the Eurasian Patent Convention. The organization’s office carries out the administrative functions of the system and issues Eurasian patents under its rules. In threat-intelligence listings, Eurasian Patent Organization was identified as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Eurasian Patent Organization idd5b93c627d8c View details | Other | leaked | |||
|
The Eurasian Patent Organization is an intergovernmental body based in Moscow, Russian Federation, that administers the Eurasian patent system for inventions and industrial designs. It provides a single regional filing and examination framework that can lead to patent protection across the contracting states of the Eurasian Patent Convention. The organization’s office carries out the administrative functions of the system and issues Eurasian patents under its rules. In threat-intelligence listings, Eurasian Patent Organization was identified as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Robert Malley emails and messages id4e093c49e017 View details | Other | leaked | |||
|
Robert Malley emails and messages is a leak-oriented record tied to Robert Malley’s private correspondence, including email and direct-message content associated with his official X account. The material relates to a U.S.-based public official’s communications, not a commercial product or service, so it is categorized in the Other sector. In reporting on the disclosure, the content was described as thousands of messages and a large set of emails made public online. The listing is presented as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Port of Fujairah idf34ca45df6f0 View details | Other | leaked | |||
|
The Port of Fujairah is a deep, multi-purpose seaport located in Fujairah, United Arab Emirates, on the Gulf of Oman. Strategically positioned on the eastern seaboard of the UAE, just 70 nautical miles from the Strait of Hormuz, it serves as a key shipping hub for the region. The port handles general cargo, bulk cargo, and wet bulk cargo while providing various marine services. A special zone for oil companies has been established north of the port to support the oil industry. The Port of Fujairah was neutrally listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Corte Suprema de Justicia idf1c97c218919 View details | Other | leaked | |||
|
Corte Suprema de Justicia es la máxima autoridad de la jurisdicción ordinaria en Colombia y forma parte del sector gubernamental-judicial. Tiene su sede en Bogotá y, a través de su portal oficial, publica decisiones, jurisprudencia, noticias y servicios judiciales para la consulta pública. La corporación actúa como tribunal de cierre en materias como casación y unificación de jurisprudencia, con salas especializadas que resuelven asuntos civiles, penales y laborales. En el índice de amenazas, fue listada como víctima de ransomware asociada con ddosecret. |
||||||
| Ransomware | Andrade Gutierrez id903b03723f62 View details | Other | leaked | |||
|
Andrade Gutierrez is a Brazilian multinational construction and civil engineering conglomerate founded in 1948 and headquartered in Belo Horizonte, Brazil. The company has worked on infrastructure and other large-scale projects across Brazil and internationally, with business interests spanning civil construction, energy, telecommunications, and related sectors. It is also described as one of Brazil’s largest contractors, with operations reported in Latin America, Africa, and Europe. Andrade Gutierrez was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Andrade Gutierrez id903b03723f62 View details | Other | leaked | |||
|
Andrade Gutierrez is a Brazilian multinational construction and civil engineering conglomerate founded in 1948 and headquartered in Belo Horizonte, Brazil. The company has worked on infrastructure and other large-scale projects across Brazil and internationally, with business interests spanning civil construction, energy, telecommunications, and related sectors. It is also described as one of Brazil’s largest contractors, with operations reported in Latin America, Africa, and Europe. Andrade Gutierrez was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Supreme Judiciary Council of Oman id049ea36e5956 View details | Other | leaked | |||
|
The Supreme Judiciary Council of Oman is a government institution in the Sultanate of Oman that oversees judicial affairs and supports the operation and development of the courts, public prosecution, and notary public services. Based in Oman, it helps shape judicial policy and legal administration, with responsibilities that include reinforcing the rule of law and supporting judicial independence. Its public-facing role is institutional rather than commercial, centered on governance and legal services. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Royal Guard of Oman id286301f96857 View details | Other | leaked | |||
|
Royal Guard of Oman is a state security and ceremonial military unit based in Oman, with a presence in Muscat and Seeb, and it is responsible for protecting the President and the Royal Family. Public profiles also describe Royal Guard of Oman Pension Fund in Muscat, indicating an affiliated pension and administrative structure tied to the organization. In addition to protective duties, the unit operates training and music-related functions, reflecting a broader institutional role within the Omani public sector. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Rosatom State Corporation Electronic Trading Platform id5aab11d5b86a View details | Other | leaked | |||
|
Rosatom State Corporation Electronic Trading Platform is an electronic procurement and trading platform tied to Rosatom, Russia’s state atomic energy corporation headquartered in Moscow. Rosatom says the majority of its procurement is conducted through electronic trading platforms, reflecting the platform’s role in supporting purchasing and supplier activity across the corporation’s operations. As a Rosatom-related business service, it sits within the broader other sector rather than a standalone consumer brand. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Psyclone Media id3d5421efbe33 View details | Other | leaked | |||
|
Psyclone Media, Inc. is a U.S.-based digital media and marketing company founded in 2003, with a public presence in New York and Washington, D.C. Its website describes the company as focused on distinctive visual solutions for marketing and advertising, as well as digital branding and web development services. Available contact information places its New York office in Massapequa Park, New York. In threat-intelligence indexing, Psyclone Media was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | New Nation News Forum id51f7b1f1327c View details | Other | leaked | |||
|
New Nation News Forum is a media-related forum or news outlet in the United States, associated by name with the NewsNation brand and the broader cable-news sector. NewsNation is an American cable news network based in Chicago, Illinois, owned by Nexstar Media Group, and it provides national news coverage through U.S. television platforms. As a forum-style or news-discussion property, New Nation News Forum fits an Other sector classification when a more specific industry label is unavailable. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Metropolitan Police Department D.C. ide466945d0c93 View details | Public Sector | leaked | |||
|
Metropolitan Police Department D.C. is the primary municipal law-enforcement agency for Washington, D.C., operating under local D.C. government control and serving the District’s 68 square miles. It employs sworn officers and civilian staff who handle policing, patrol, investigations, and public safety support across the city. The department also organizes its service area through police districts and police service areas, with dedicated operational and career functions for residents and the workforce. In threat-intelligence catalogs, Metropolitan Police Department D.C. was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | MBK Auditing id2cfb43421357 View details | Other | leaked | |||
|
MBK Auditing is a UAE-based auditing and business advisory firm with offices in Dubai and Abu Dhabi. It provides auditing, accounting, tax, bookkeeping, internal audit, and related compliance and risk-management services for corporate and SME clients. The company presents itself as a multidisciplinary professional services provider serving businesses in the United Arab Emirates and beyond. MBK Auditing was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Israel Defense Forces (Ganosec) id93972d1022bd View details | Other | leaked | |||
|
Israel Defense Forces (IDF) is the military force of the State of Israel, headquartered in Israel and responsible for safeguarding the country and its residents against threats. It comprises the Ground Forces, Air Force, and Navy, and its public mission centers on national defense and military operations. In threat-intelligence catalogs, the name may appear with a source label such as Ganosec, while the sector is categorized as Other when the organization does not fit a standard commercial industry classification. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Israel Defense Forces (Anonymous For Justice) id7ae64621e849 View details | Other | leaked | |||
|
Israel Defense Forces (Anonymous For Justice) is an Israel-based entity associated with the country’s military and military justice environment, operating within the broader public-sector and defense context. The IDF maintains a multi-layered military justice system, including the Military Advocate General’s Corps, the Military Police Criminal Investigation Division, and military courts, with civilian oversight from the Attorney General of Israel. In that system, the MAG Corps provides legal advice and enforces military and criminal law across the IDF, while the MPCID investigates allegations of criminal offences. In threat-intelligence cataloging, this entry is classified as a ransomware victim and linked to ddosecret. |
||||||
| Ransomware | Heritage Foundation (2024) id7ccafaa706f8 View details | Other | leaked | |||
|
Heritage Foundation (2024) refers to The Heritage Foundation, a Washington, D.C.-based American conservative public policy research organization and think tank. It is a nonprofit research and educational institution that develops and promotes policy proposals on free enterprise, limited government, individual freedom, traditional American values, and national defense. Its work serves policymakers, media, and public audiences through research and policy analysis. In threat-intelligence catalogs, it was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Heritage Foundation (2015) idb59154bedc9e View details | Other | leaked | |||
|
Heritage Foundation (2015) is an American conservative think tank based in Washington, D.C., founded in 1973. It operates as a research and educational institution that develops and promotes public policy ideas, including reports, policy agendas, and advocacy materials. In its work, it focuses on analysis of government, economics, and social policy for a U.S. audience. The entity was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Gaza, Volume 05 ide606068c3e2d View details | Other | leaked | |||
|
Gaza, Volume 05 is a named entry in a ransomware-victim index for the Other sector, with no additional public business description available in the provided sources. The name indicates a Gaza-based or Gaza-referenced entity, but the listing itself does not identify specific offerings, products, or services. In threat-intelligence records, this type of entry is used to track organizations or targets that appear in ransomware leak ecosystems. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Gaza, Volume 04 idd6fe3661037c View details | Other | leaked | |||
|
Gaza, Volume 04 is an entity listed in the Other sector and associated with Palestine in the threat-intelligence record. The listing identifies it as a ransomware victim entry rather than describing a specific business line, so its offerings and operations are not detailed in the available source. The record is used to catalog victims named by ransomware-related reporting and to support incident tracking across sectors. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Gaza, Volume 03 id1aec23a7ef32 View details | Other | leaked | |||
|
Gaza, Volume 03 is an entity operating in the Other sector, with its location in Gaza, Palestine. It offers unspecified services typical of its sector, though specific offerings are not publicly detailed. The entity was listed as a ransomware victim associated with the ddosecret threat actor. This listing reflects its inclusion in a collection of corporate secrets shared by DDoSecrets, a whistleblower group. No confirmed breach details or stolen data types are disclosed in available reports. |
||||||
| Ransomware | Gaza, Volume 02 id679914a817c6 View details | Other | leaked | |||
|
Gaza, Volume 02 appears in a ransomware-victim index as an entity in the **Other** sector, with no additional public operational profile provided in the listing. Based on the name alone, it cannot be reliably identified as a specific company, so no firm claims can be made about its offerings or business activities from the available record. In ransomware threat-intelligence contexts, a listed name typically indicates that the entity was named by an extortion or leak operation rather than described as a confirmed breach by the organization itself. It was listed as a ransomware victim associated with **ddosecret**. |
||||||
| Ransomware | Gaza, Volume 01 idbc74cd020ff5 View details | Other | leaked | |||
|
Gaza, Volume 01 is a threat-intelligence catalog entry for an entity named Gaza, Volume 01 in the Other sector, with the available listing indicating no further public business profile. As a victim record, it is used to index ransomware-related activity tied to a named target rather than to describe a confirmed service, product, or operational offering. Publicly available data do not provide a reliable company description, so the listing should be treated as a minimal identity record for intelligence correlation. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Free Speech Union donor data idbf8fb89c4152 View details | Other | leaked | |||
|
The Free Speech Union donor data comprises leaked records of individuals who donated £50 or more to the British membership organisation's crowdfunding campaigns, exposing funding from ultra-wealthy supporters rather than grassroots citizens. This data, originating from the UK, reveals donations to campaigns defending controversial figures and includes contributions exceeding £10,000 from specific ultra-wealthy individuals. The Free Speech Union, founded in 2020 by Toby Young, campaigns for freedom of speech and defends the speech rights of its members across the UK. The leaked records were published by BASH BACK and subsequently distributed by Distributed Denial of Secrets, highlighting the organisation's reliance on deep-pocketed donors. This entity was listed as a ransomware victim associated with the ddosecret threat actor. |
||||||
| Ransomware | Dígitro id0d3bd25cec6c View details | Other | leaked | |||
|
Dígitro is a Brazilian technology company based in Florianópolis, Santa Catarina, with additional operations in São Paulo and Brasília. The company says it has more than 300 employees and serves thousands of clients across Brazil and Latin America, with product offerings centered on investigative intelligence solutions, communications, and SaaS for business modernization. Public descriptions also place Dígitro in the public safety and intelligence technology market. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Dígitro id0d3bd25cec6c View details | Other | leaked | |||
|
Dígitro is a Brazilian technology company based in Florianópolis, Santa Catarina, with additional operations in São Paulo and Brasília. The company says it has more than 300 employees and serves thousands of clients across Brazil and Latin America, with product offerings centered on investigative intelligence solutions, communications, and SaaS for business modernization. Public descriptions also place Dígitro in the public safety and intelligence technology market. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Douglas Valentine collection id055154fe7e73 View details | Other | leaked | |||
|
Douglas Valentine collection is an Other-sector collection based in the United States, described as thousands of leaked and Freedom of Information Act documents, recorded interviews, and related research materials gathered by writer, poet, and investigator Douglas Valentine. The collection focuses on U.S. government and intelligence topics, including the CIA, the Federal Bureau of Narcotics, the Mafia, MKULTRA, the Phoenix Program, and related investigations. Its materials appear to serve as a documentary research archive rather than a commercial product or service. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | DNC Emails idcd2046ffd708 View details | Other | leaked | |||
|
DNC Emails refers to an email collection associated with the U.S. Democratic National Committee, a political organization in the United States. The listing indicates a dataset of more than 44,000 emails and places it in the Other sector rather than a commercial industry category. Distributed Denial of Secrets (DDoSecrets) published the item as part of its archive of ransomware-related leak material, which it describes as information attackers had already made public. In this context, DNC Emails is presented as an indexed victim record rather than a standalone company offering products or services. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | DNC Emails idcd2046ffd708 View details | Other | leaked | |||
|
DNC Emails refers to an email collection associated with the U.S. Democratic National Committee, a political organization in the United States. The listing indicates a dataset of more than 44,000 emails and places it in the Other sector rather than a commercial industry category. Distributed Denial of Secrets (DDoSecrets) published the item as part of its archive of ransomware-related leak material, which it describes as information attackers had already made public. In this context, DNC Emails is presented as an indexed victim record rather than a standalone company offering products or services. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Disney internal Slack idaa1757ef9cb9 View details | Other | leaked | |||
|
Disney internal Slack refers to The Walt Disney Company’s internal Slack-based messaging environment used for employee communications and collaboration. The Walt Disney Company is a Burbank, California-based mass media and entertainment conglomerate in the United States, operating across film, television, streaming, parks, and related media businesses. Public reporting on the incident described internal Slack channels and related business communications as the material exposed in the case. The entity was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | DHS Contracts id4359980c1ab7 View details | Other | leaked | |||
|
DHS Contracts refers to contract opportunities and awards connected to the U.S. Department of Homeland Security, a federal cabinet department responsible for public security, border control, cybersecurity, transportation security, and emergency response. DHS procurement spans professional services, IT, software, cybersecurity, and related mission support offerings, with opportunities commonly managed through federal acquisition systems such as SAM.gov. As a federal buyer, DHS works with vendors, small businesses, and integrators that meet registration, compliance, and performance requirements. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | CUSAEM Policía Auxiliar id0bc1ed2f075a View details | Other | leaked | |||
|
CUSAEM Policía Auxiliar, also identified as the Policía Auxiliar del Estado de México, is a public security auxiliary corps in Mexico that provides protective services and operational support. Its services are presented for businesses, corporates, industries, logistics centers, and warehouses in Mexico City and the State of Mexico, with a contact address in the State of Mexico. As an auxiliary policing organization, it operates in the broader security sector rather than as a conventional commercial firm. In ransomware tracking data, CUSAEM Policía Auxiliar was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Cryptome Archive (2024) idc7ecefd60472 View details | Other | leaked | |||
|
Cryptome Archive (2024) is an online library and archive associated with the Other sector, based in New York, United States. Cryptome has published material on freedom of expression, privacy, cryptography, dual-use technologies, national security, intelligence, and government secrecy, and it operates as a long-running public information repository. In 2024, the archive was listed in connection with a ransomware incident by ddosecret. The listing identified Cryptome Archive (2024) as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Bahrain Royal Flight idca8fe0434c18 View details | Other | leaked | |||
|
Bahrain Royal Flight is a Bahrain-based government aviation service headquartered in Muharraq, Al Janūbīyah, Bahrain, with a recorded headquarters address in PO Box 22394. It operates as a special-purpose air transport provider for official VIP travel and related state aviation needs, and aviation directories identify it as Bahrain’s royal flight service. Flight-tracking and aviation sources also show the entity using the BAH identifier and operating a fleet of aircraft. In threat-intelligence listings, Bahrain Royal Flight was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Andrew Tate's The Real World idcaaf4a821da0 View details | Other | leaked | |||
|
Andrew Tate's The Real World is an online membership platform in the Other sector, based in the United Kingdom, that offers subscription-based training in money-making skills and access to a private community. Public descriptions say it provides structured learning tracks, mentorship-style guidance, and lessons in areas such as copywriting, freelancing, e-commerce, crypto, and other online income streams. The service is marketed as a paid educational community rather than a traditional software or retail business. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Vered Haimovich emails id99f69dd5d43b View details | Other | leaked | |||
|
Vered Haimovich emails belong to a senior executive at Elbit Systems, an Israel-based aerospace and defense company specializing in unmanned aerial systems and innovation. The entity operates in the aerospace sector, with offerings focused on UAV business units and strategic business development. Elbit Systems serves global defense markets, leveraging advanced drone technology for modern warfare applications. Vered Haimovich, a Vice President of Business Development and Innovation, leads key initiatives in the company's UAS division. The listing was neutrally recorded as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Vered Haimovich emails id99f69dd5d43b View details | Other | leaked | |||
|
Vered Haimovich emails belong to a senior executive at Elbit Systems, an Israel-based aerospace and defense company specializing in unmanned aerial systems and innovation. The entity operates in the aerospace sector, with offerings focused on UAV business units and strategic business development. Elbit Systems serves global defense markets, leveraging advanced drone technology for modern warfare applications. Vered Haimovich, a Vice President of Business Development and Innovation, leads key initiatives in the company's UAS division. The listing was neutrally recorded as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Syrian Censorship logs idba8d693c6ae8 View details | Other | leaked | |||
|
Syrian Censorship logs refers to a leaked set of Blue Coat filter logs tied to internet censorship in the Syrian Arab Republic, showing how authorities filtered online traffic through targeted controls. The material has been described as revealing censorship methods such as IP-, domain-, keyword-, and category-based blocking, affecting services and content including messaging and political sites. In the threat-intelligence context, the listing is categorized under sector Other and represents a dataset rather than a conventional operating business. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Egypt Upstream Gateway id0ec17742f5d4 View details | Other | leaked | |||
|
Egypt Upstream Gateway (EUG) is a national digital platform that provides seamless online access to over 100 years of accumulated onshore and offshore seismic and non-seismic data for Egypt's oil and gas sector. Operated under the Egyptian Ministry of Petroleum in partnership with Schlumberger, EUG digitally promotes Egypt's bid rounds and exploration potential by delivering advanced data visualization and geological insights. The platform facilitates access to project services through membership tiers and manages vast exploration and production data stored in the National Data Repository with strict security regimes. Egypt Upstream Gateway was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Egypt Upstream Gateway id0ec17742f5d4 View details | Other | leaked | |||
|
Egypt Upstream Gateway (EUG) is a national digital platform that provides seamless online access to over 100 years of accumulated onshore and offshore seismic and non-seismic data for Egypt's oil and gas sector. Operated under the Egyptian Ministry of Petroleum in partnership with Schlumberger, EUG digitally promotes Egypt's bid rounds and exploration potential by delivering advanced data visualization and geological insights. The platform facilitates access to project services through membership tiers and manages vast exploration and production data stored in the National Data Repository with strict security regimes. Egypt Upstream Gateway was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | NATO Volumes I-III id41a33658ada2 View details | Other | leaked | |||
|
NATO Volumes I-III is a defense-related publication set associated with NATO’s science and technology work, covering volumes that assess future security, capability, and technology trends across the Alliance. NATO’s Science & Technology Trends materials are designed to inform planning, preparedness, and industrial and research priorities for member states and partners. The listing reflects an Other-sector entity with a NATO-linked context rather than a commercial product or service provider. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | NATO Volumes I-III id41a33658ada2 View details | Other | leaked | |||
|
NATO Volumes I-III is a defense-related publication set associated with NATO’s science and technology work, covering volumes that assess future security, capability, and technology trends across the Alliance. NATO’s Science & Technology Trends materials are designed to inform planning, preparedness, and industrial and research priorities for member states and partners. The listing reflects an Other-sector entity with a NATO-linked context rather than a commercial product or service provider. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Raz Zimmt chats idd30c221bbf5d View details | Other | leaked | |||
|
Raz Zimmt chats is an Other-sector entity in Israel whose public-facing presence suggests an information or commentary-oriented service centered on Raz Zimmt. Available web results identify Raz Zimmt as an Israeli Iran expert and senior researcher at the Institute for National Security Studies, but they do not provide verified business details for a separate company or product named Raz Zimmt chats. In a threat-intelligence index, the name should therefore be treated cautiously and described only from the available evidence. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Digitro ide42727b91a9a View details | Other | leaked | |||
|
Digitro is a Brazilian technology company based in Florianopolis, Santa Catarina, with a long operating history in software, communications, and IT solutions. Sources describe it as serving public- and private-sector clients across Brazil and Latin America, with offerings that include telecommunications, public safety, and enterprise technology solutions. It is also described as part of the information and communication technology sector and as a company with broad experience in the public and private markets. Digitro was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Bechtel idc9bdefa962dd View details | Other | leaked | |||
|
Bechtel Corporation is a global engineering, construction, procurement, and project management firm headquartered in Reston, Virginia. It is recognized as the largest construction company in the United States and has been involved in high-profile projects such as the Hoover Dam and the Channel Tunnel. The company serves markets including Energy, Infrastructure, Manufacturing & Technology, Mining & Metals, and Nuclear, Security & Environmental. Bechtel creates sustainable solutions that drive global progress since 1898. Bechtel was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Audit Service Sierra Leone id0fd5cf2cf23c View details | Other | leaked | |||
|
Audit Service Sierra Leone is Sierra Leone’s Supreme Audit Institution, based in Freetown, and the country’s Audit Service Act defines its role as auditing and reporting on public accounts and related public bodies. Its mandate includes auditing central and local government, public enterprises, the central bank, state-owned commercial banks, and other state-owned financial corporations. In a broader accountability context, the organization supports public-sector auditing and oversight in Sierra Leone. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Secretaría Técnica Consejo Nacional de Seguridad id787757da3fe5 View details | Other | leaked | |||
|
La Secretaría Técnica Consejo Nacional de Seguridad (STCNS) es un órgano público de Guatemala que actúa como instancia permanente, profesional y especializada de apoyo técnico y administrativo al Consejo Nacional de Seguridad. Su función es garantizar el funcionamiento del consejo en materia de coordinación y gestión de seguridad nacional, dentro del sector gubernamental. Con sede en Guatemala, su labor se orienta al soporte institucional y a la articulación de procesos de seguridad del Estado. Fue listada como víctima de ransomware asociada con ddosecret. |
||||||
| Ransomware | Secretaría Técnica Consejo Nacional de Seguridad id787757da3fe5 View details | Other | leaked | |||
|
La Secretaría Técnica Consejo Nacional de Seguridad (STCNS) es un órgano público de Guatemala que actúa como instancia permanente, profesional y especializada de apoyo técnico y administrativo al Consejo Nacional de Seguridad. Su función es garantizar el funcionamiento del consejo en materia de coordinación y gestión de seguridad nacional, dentro del sector gubernamental. Con sede en Guatemala, su labor se orienta al soporte institucional y a la articulación de procesos de seguridad del Estado. Fue listada como víctima de ransomware asociada con ddosecret. |
||||||
| Ransomware | Karasu Operating Company id82f7bf1b61fc View details | Other | leaked | |||
|
Karasu Operating Company is an Azerbaijan-based oil and gas exploration and services firm headquartered in Baku. Public business directories and industry listings place it in the oil and gas exploration, drilling, and production segment, with operations tied to petroleum field activity in Azerbaijan. The company is also associated with the Karasu name in local business records and trade listings. In threat-intelligence catalogs, Karasu Operating Company was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Karasu Operating Company id82f7bf1b61fc View details | Other | leaked | |||
|
Karasu Operating Company is an Azerbaijan-based oil and gas exploration and services firm headquartered in Baku. Public business directories and industry listings place it in the oil and gas exploration, drilling, and production segment, with operations tied to petroleum field activity in Azerbaijan. The company is also associated with the Karasu name in local business records and trade listings. In threat-intelligence catalogs, Karasu Operating Company was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Groupement Bir Seba id55ba6765e816 View details | Other | leaked | |||
|
Groupement Bir Seba is an oil and gas industry operator located in Ouargla, Algeria, specializing in the development and production of conventional oil fields such as the Bir Seba Complex. The entity oversees multiple phases of the Bir Seba Project, including Bir Seba 1 and 2 Oil Phases, which are key components of Algeria's upstream energy sector. It has engaged major contractors for EPC and separation unit projects to advance field development in the Oued Mya Basin. Groupement Bir Seba was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Groupement Bir Seba id55ba6765e816 View details | Other | leaked | |||
|
Groupement Bir Seba is an oil and gas industry operator located in Ouargla, Algeria, specializing in the development and production of conventional oil fields such as the Bir Seba Complex. The entity oversees multiple phases of the Bir Seba Project, including Bir Seba 1 and 2 Oil Phases, which are key components of Algeria's upstream energy sector. It has engaged major contractors for EPC and separation unit projects to advance field development in the Oued Mya Basin. Groupement Bir Seba was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | SOCAR-STP id87cbb9d81b4c View details | Other | leaked | |||
|
SOCAR-STP LLC is a joint venture established on February 19, 2020, between Azerbaijan's State Oil Company (SOCAR) and Sumgayit Technologies Park (STP), which is part of the Azerbaijani Azenco company engaged in energy sector construction. The company operates in the Oil and Gas industry with its headquarters in Baku, Azerbaijan, specifically in the H.Z. Tagiyev settlement of Sumgait. It provides specialized capabilities for the energy, construction, oil and gas, automobile, heavy duty machines, aviation, and shipyard sectors. SOCAR-STP was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | SOCAR-STP id87cbb9d81b4c View details | Other | leaked | |||
|
SOCAR-STP LLC is a joint venture established on February 19, 2020, between Azerbaijan's State Oil Company (SOCAR) and Sumgayit Technologies Park (STP), which is part of the Azerbaijani Azenco company engaged in energy sector construction. The company operates in the Oil and Gas industry with its headquarters in Baku, Azerbaijan, specifically in the H.Z. Tagiyev settlement of Sumgait. It provides specialized capabilities for the energy, construction, oil and gas, automobile, heavy duty machines, aviation, and shipyard sectors. SOCAR-STP was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Binagadi Oil idb267fcab3a0e View details | Other | leaked | |||
|
Binagadi Oil is a petroleum refinery company based in Baku, Azerbaijan, founded in 1989. It operates in the oil and gas sector, with business activity centered on refining, storage, and distribution of refined petroleum products. Public company listings also describe it as an active importer in Azerbaijan, reflecting trade-related operations alongside its refinery business. In threat-intelligence indexes, Binagadi Oil was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Binagadi Oil idb267fcab3a0e View details | Other | leaked | |||
|
Binagadi Oil is a petroleum refinery company based in Baku, Azerbaijan, founded in 1989. It operates in the oil and gas sector, with business activity centered on refining, storage, and distribution of refined petroleum products. Public company listings also describe it as an active importer in Azerbaijan, reflecting trade-related operations alongside its refinery business. In threat-intelligence indexes, Binagadi Oil was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Absheron Operating Company idb3cfd350379d View details | Other | leaked | |||
|
Absheron Operating Company is an Azerbaijan-based oil and gas company operating from Baku, with a business profile centered on exploration, production, and related petroleum services. Company listings and project references place it in the country’s energy sector and associate it with the Absheron gas and condensate field in Azerbaijan. Public company materials describe it as a vertically integrated oil and gas operator. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Absheron Operating Company idb3cfd350379d View details | Other | leaked | |||
|
Absheron Operating Company is an Azerbaijan-based oil and gas company operating from Baku, with a business profile centered on exploration, production, and related petroleum services. Company listings and project references place it in the country’s energy sector and associate it with the Absheron gas and condensate field in Azerbaijan. Public company materials describe it as a vertically integrated oil and gas operator. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Modesto Police Department id71e62d902e1d View details | Public Sector | leaked | |||
|
Modesto Police Department is the municipal law enforcement agency serving the City of Modesto in California, a public sector organization focused on policing, crime prevention, and community safety. The department says its mission is to reduce crime and improve quality of life in Modesto, and it operates with sworn officers and professional staff who provide patrol, investigations, and related police services. Its public-facing operations also include recruitment and community engagement functions for city residents and applicants. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Modesto Police Department id71e62d902e1d View details | Public Sector | leaked | |||
|
Modesto Police Department is the municipal law enforcement agency serving the City of Modesto in California, a public sector organization focused on policing, crime prevention, and community safety. The department says its mission is to reduce crime and improve quality of life in Modesto, and it operates with sworn officers and professional staff who provide patrol, investigations, and related police services. Its public-facing operations also include recruitment and community engagement functions for city residents and applicants. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Fidinam DMCC id6ebd9285d60c View details | Other | leaked | |||
|
Fidinam DMCC is a Dubai-based consulting firm operating in the other sector, with a presence in Jumeirah Lake Towers, Dubai, United Arab Emirates. Fidinam states that it provides customized services based on local expertise developed on an international scale, including tax, business, real estate, corporate, immigration, and residency-related consulting. The wider Fidinam group also describes itself as a private consulting firm founded in Lugano in 1960, supporting companies and individuals across business and digital advisory services. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Fidinam DMCC id6ebd9285d60c View details | Other | leaked | |||
|
Fidinam DMCC is a Dubai-based consulting firm operating in the other sector, with a presence in Jumeirah Lake Towers, Dubai, United Arab Emirates. Fidinam states that it provides customized services based on local expertise developed on an international scale, including tax, business, real estate, corporate, immigration, and residency-related consulting. The wider Fidinam group also describes itself as a private consulting firm founded in Lugano in 1960, supporting companies and individuals across business and digital advisory services. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Tamir Hayman emails id9a1b60b0f673 View details | Other | leaked | |||
|
Tamir Hayman emails refers to an email-based target associated with Tamir Hayman, an Israeli national-security figure who serves as Executive Director of the Institute for National Security Studies (INSS) in Tel Aviv. In threat-intelligence catalogs, the listing is treated as an Other-sector target rather than a commercial company, and the public record available here does not provide an official business offering or operating profile beyond his institutional role. The name also appears in a ransomware-intelligence victim entry that tracks claimed incidents involving his mailbox or email exposure. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Raz Zimmt emails id5a1affda7d21 View details | Other | leaked | |||
|
Raz Zimmt emails refers to material tied to Raz Zimmt, an Israeli Iran-focused analyst and director of the Iran and the Shiite Axis research program at the Institute for National Security Studies (INSS) in Tel Aviv, Israel. Public profiles describe Zimmt as a senior researcher and Iran specialist whose work centers on Iranian politics, security, and regional strategy. The listing name suggests alleged email or chat content connected to his professional communications, not a business offering or consumer service. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | MLA-ACLS-AHA Depositions id6c802dfe4600 View details | Other | leaked | |||
|
MLA-ACLS-AHA Depositions refers to a matter involving the Modern Language Association (MLA), the American Council of Learned Societies (ACLS), and the American Historical Association (AHA), three U.S.-based humanities organizations that advocate for scholarship, research, and public humanities funding. Public reporting shows these groups jointly pursued legal action over National Endowment for the Humanities (NEH) funding and program changes, and their filings included depositions tied to that dispute. The entity is cataloged in the Other sector and is associated in threat-intelligence listings with ddosecret. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | MLA-ACLS-AHA Depositions id6c802dfe4600 View details | Other | leaked | |||
|
MLA-ACLS-AHA Depositions refers to a matter involving the Modern Language Association (MLA), the American Council of Learned Societies (ACLS), and the American Historical Association (AHA), three U.S.-based humanities organizations that advocate for scholarship, research, and public humanities funding. Public reporting shows these groups jointly pursued legal action over National Endowment for the Humanities (NEH) funding and program changes, and their filings included depositions tied to that dispute. The entity is cataloged in the Other sector and is associated in threat-intelligence listings with ddosecret. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Kash Patel emails idec2825ef2b6d View details | Other | leaked | |||
|
Kash Patel emails is a listed cyber incident entry in the Other sector in the United States, referring to personal email communications associated with Kash Patel. Public reporting describes the compromised account as a personal email account rather than an organizational service, and notes that the material shared online included personal and email content. The entry is relevant to threat-intelligence cataloging because it ties a named individual account to an exposure event with public reporting from March 2026. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Kash Patel emails idec2825ef2b6d View details | Other | leaked | |||
|
Kash Patel emails is a listed cyber incident entry in the Other sector in the United States, referring to personal email communications associated with Kash Patel. Public reporting describes the compromised account as a personal email account rather than an organizational service, and notes that the material shared online included personal and email content. The entry is relevant to threat-intelligence cataloging because it ties a named individual account to an exposure event with public reporting from March 2026. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | ICE Contracts id015630dd1daf View details | Other | leaked | |||
|
ICE Contracts is a United States-based entity name associated with federal immigration and enforcement contracting, a broad services area that can include detention support, facility operations, logistics, and related administrative work. Public policy sources describe ICE contracts as awards to private companies for services such as guards, food, maintenance, construction, and other support functions tied to immigration enforcement. In that context, the name most likely refers to an organization or business involved in supplying goods or services under ICE-related contracts, rather than a consumer-facing brand. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | dotWin network id11dee3577a6e View details | Other | leaked | |||
|
dotWin network is categorized in the Other sector, indicating a business or organization that does not fit a more specific industry label in the available intelligence record. Publicly available information in the search results does not provide a verified location, products, or services for this entity, so a more detailed business profile cannot be stated with confidence. In threat-intelligence catalogs, such entries are typically used to index named organizations reported in incident tracking. In this listing, dotWin network was associated with a ransomware victim report linked to ddosecret. |
||||||
| Ransomware | dotWin network id11dee3577a6e View details | Other | leaked | |||
|
dotWin network is categorized in the Other sector, indicating a business or organization that does not fit a more specific industry label in the available intelligence record. Publicly available information in the search results does not provide a verified location, products, or services for this entity, so a more detailed business profile cannot be stated with confidence. In threat-intelligence catalogs, such entries are typically used to index named organizations reported in incident tracking. In this listing, dotWin network was associated with a ransomware victim report linked to ddosecret. |
||||||
| Ransomware | Free Speech Union idmJ2PcJQ9IDsc View details | Other | leaked | |||
|
The Free Speech Union is a UK membership organisation based in London that campaigns for freedom of speech and supports members on speech-related issues. Its public materials describe it as a non-partisan body providing legal work, campaigning, and member support. The organisation is associated with the civic and social organizations sector and operates from London, England. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Ayelet Shaked idoU8PNBrETGBJ View details | Other | leaked | |||
|
Ayelet Shaked is an Israeli former politician, activist, and software engineer who served as Minister of Interior from 2021 to 2022 and as Minister of Justice in earlier roles. She is now chairperson of the Kardan Real Estate Group board of directors, pending board approval, marking her transition to non-political employment in the real estate sector. Her background includes software engineering and political leadership focused on domestic policy and justice reform in Israel. Ayelet Shaked was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Ayelet Shaked idoU8PNBrETGBJ View details | Other | leaked | |||
|
Ayelet Shaked is an Israeli former politician, activist, and software engineer who served as Minister of Interior from 2021 to 2022 and as Minister of Justice in earlier roles. She is now chairperson of the Kardan Real Estate Group board of directors, pending board approval, marking her transition to non-political employment in the real estate sector. Her background includes software engineering and political leadership focused on domestic policy and justice reform in Israel. Ayelet Shaked was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Inside CECOT idgAEzKf0v9SPW View details | Other | leaked | |||
|
Inside CECOT is a 60 Minutes documentary segment that explores the Terrorism Confinement Center (CECOT), a maximum security prison located in Tecoluca, El Salvador. The facility, inaugurated in February 2023, serves as a detention center for high-ranking gang members and is the largest prison in the Americas, with a capacity of 40,000 inmates. The segment provides an authoritative look at the prison’s operations, human rights concerns, and its role in El Salvador’s anti-gang campaign. Inside CECOT was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | Inside CECOT idgAEzKf0v9SPW View details | Other | leaked | |||
|
Inside CECOT is a 60 Minutes documentary segment that explores the Terrorism Confinement Center (CECOT), a maximum security prison located in Tecoluca, El Salvador. The facility, inaugurated in February 2023, serves as a detention center for high-ranking gang members and is the largest prison in the Americas, with a capacity of 40,000 inmates. The segment provides an authoritative look at the prison’s operations, human rights concerns, and its role in El Salvador’s anti-gang campaign. Inside CECOT was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||
| Ransomware | DDoSecrets-AES idopiwHxlFDU3f View details | Other | leaked | |||
|
DDoSecrets-AES is a threat-intelligence catalog entry for an entity in the **Other** sector, with no public business profile or offering details established in the available sources. DDoSecrets is widely known as Distributed Denial of Secrets, a leak-publishing group that has shared large volumes of ransomware-related material obtained from criminal sites. In this context, the name appears as an indexed victim label rather than a description of a commercial organization. The listing identifies DDoSecrets-AES as a **ransomware victim** associated with **ddosecret**. |
||||||
| Ransomware | DDoSecrets-AES idopiwHxlFDU3f View details | Other | leaked | |||
|
DDoSecrets-AES is a threat-intelligence catalog entry for an entity in the **Other** sector, with no public business profile or offering details established in the available sources. DDoSecrets is widely known as Distributed Denial of Secrets, a leak-publishing group that has shared large volumes of ransomware-related material obtained from criminal sites. In this context, the name appears as an indexed victim label rather than a description of a commercial organization. The listing identifies DDoSecrets-AES as a **ransomware victim** associated with **ddosecret**. |
||||||
| Ransomware | Washington Post idO3o02fbua48Z View details | Other | leaked | |||
|
The Washington Post is a major American news organization based in Washington, D.C., with reporting and editorial operations that cover U.S. and world news, politics, business, technology, opinion, and multimedia coverage. It publishes breaking news, investigations, analysis, video, photos, and opinion content for a national and global audience. The company operates in the media sector and maintains offices in Washington, New York, Chicago, San Francisco, and Springfield, Virginia. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | ddosecrets-2025-11-16.aes256 id67HBOMaVwaeD View details | Other | leaked | |||
|
ddosecrets-2025-11-16.aes256 is a threat-intelligence index entry for an entity in the Other sector, with no public industry or service detail evident from the name alone. The listing is associated with ddosecret, a source name that aligns with Distributed Denial of Secrets, a U.S.-based public-interest leak publication and archive. As cataloged here, the entry identifies a ransomware victim record rather than describing products, location-specific operations, or a confirmed incident narrative. It was listed as a ransomware victim associated with ddosecret. |
||||||
| Ransomware | Protei id3uAOjgrTbFVZ View details | Communication / Marketing | leaked | |||
|
PROTEI is an international telecommunications and IT-systems vendor headquartered in Amman, Jordan, operating across Eastern Europe, Central Asia, Latin America, the Middle East, and North Africa. The company offers an extensive portfolio including Core Network, Roaming, Messaging, Value-Added Services, Data Charging, and Deep Packet Inspection technologies. PROTEI specializes in telecommunications infrastructure, GSM/LTE solutions, and network intelligence systems for enterprise and regional markets. It was listed as a ransomware victim associated with the threat actor ddosecret. |
||||||