Ransomware Group intelligence
Dispossessor
InactiveTrack Dispossessor with 344 published victims and 2 known leak locations in a single intelligence view.
Overview
Dispossessor is tracked by Breach House as a ransomware group with 344 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Down checked 1h ago | e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion |
| Leak location 1 | Web location | Down checked 1h ago | dispossessor.com |
Top Activity Sectors (16)
- Not identified 118
- Communication / Marketing 55
- Services 24
- Healthcare / Pharma 23
- Finance / Legal / Insurance 17
- Public Sector 16
- Energy 16
- Manufacturing / Engineering 14
- Construction / Real Estate 11
- IT 11
- Education 11
- Retail / E-commerce 9
- Transportation / Travel / Logistics 6
- Agriculture / Food 5
- Hospitality / Food & Beverage / Tourism 4
- Telecommunications 4
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Dispossessor, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: dispossessor uses PowerShell scripts to execute malicious commands and deploy payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: dispossessor modifies registry run keys to ensure ransomware reactivation after system reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: dispossessor disables antivirus tools and security monitoring utilities to evade detection during ransomware execution.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: dispossessor deletes Volume Shadow Copies and backup files via system commands to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: dispossessor accesses LSASS memory to steal credentials for persistence and lateral movement.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: dispossessor scans network shares to identify victim data locations for targeted encryption and exfiltration.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: dispossessor exploits SMB/Windows Admin Shares to move laterally between networked victim machines.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: dispossessor exfiltrates stolen sensitive data through encrypted C2 channels before demanding payment.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: dispossessor encrypts victim files using custom ransomware binaries, locking data for ransom demands.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: dispossessor halts system recovery processes and service restoration mechanisms to maximize operational impact.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (344)
Search, filter and paginate the victim timeline for Dispossessor. Showing 1–100 of 344.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | parkerdevco.com id13786 View details | United States | Construction / Real Estate | ||
|
Company name: Parker Development. Address: 4525 Serrano Parkway, Suite 100, El Dorado Hills, California 95762, CalDRE #00909351, Phone number: +1.916.939.4060 . Email: [email protected] |
|||||
| Ransomware | palig.com id13738 View details | United States | Other | ||
|
palig.com |
|||||
| Ransomware | cognizant.com id13737 View details | Ireland | Other | ||
|
cognizant.com |
|||||
| Ransomware | pwc.com id13736 View details | United States | Other | ||
|
pwc.com |
|||||
| Ransomware | Zon Beachside zonbeachside.com id13690 View details | India | Public Sector | ||
|
The City of Indian Harbour Beach is located on the East Coast of Central Florida, between the Atlantic Ocean and the Indian River Lagoon. The city is two square miles with 8,500 residents. The Indian Harbour Police Department is less than ½ mile from Zon Beachside, so emergency response is just a few minutes away. All police officers are first responders for medical emergencies and carry AED’s in each of the patrol cars. The Volunteer Fire Department is also less than ½ mile away and has 30 members and state-of-the-art equipment. Residents will enjoy Gleason Park, a 27-acre park surrounding a lake with walking trails that are shaded and lighted at night. There is a large community center that offers activities for all ages as well as a heated Olympic sized pool. |
|||||
| Ransomware | County Linen UK id13649 View details | United Kingdom | Public Sector | ||
|
County Linen is an industry leading family business with over 200 years of history. We are well established as a trusted, innovative and people-focused business. Our rich history started back in 1815, when we were known as County Laundry, and since then we have grown to become a leader in the Workwear rental and Laundry Service industry in the southeast of England. County Linen works with local hotels to provide them with clean linen and our workwear rental service provides high-quality uniforms as well as protective wear for the industrial sector, helping to create a professional image for your brand. |
|||||
| Ransomware | TNT Materials tnt-materials.com id13648 View details | United States | Other | ||
|
Data of company. Can be downloaded using Bittorrent / uTorrent. Part1 - https://workupload.com/file/Q8dggJtVd6r Part2 - https://workupload.com/file/6gg3u8Pp844 |
|||||
| Ransomware | delhihospital.com id13603 View details | India | Healthcare / Pharma | ||
|
Richland Parish Hospital Video of files 10 minutes - https://streamable.com/jh06bs . |
|||||
| Ransomware | qatar.vcu.edu id13602 View details | Qatar | Other | ||
|
https://streamable.com/k5439m - VCUarts Qatar files 10 minutes video. |
|||||
| Ransomware | tursso.com id13601 View details | United States | Other | ||
|
https://streamable.com/ixp9fn + https://streamable.com/2l7h7x videos of confidential files exfiltrated from Tursso Companies INC. |
|||||
| Ransomware | airedentalarts.com id13600 View details | United States | Healthcare / Pharma | ||
|
https://streamable.com/tkc7xk - video of files part1. |
|||||
| Ransomware | UMBRELLA PROPERTIES id13326 View details | Communication / Marketing | |||
|
VIDEO OF FILES PART1 - http://cybertube.video/web/index.html#!/details?id=782ccbf2b08c75eb63d1d90d23670518&serverId=2be5e68176ff4f8fbb930fe66321ab72 . Youtube videos will be posted, if we will not get the required payment amount . Umbrella Properties offers apartments, duplexes and townhouses for rent in many styles ranging from studios, one-bedroom, two-bedroom, and also three-bedroom units. We offer affordable housing to residents in Eugene, Springfield, Junction City and Bend. In a concerning turn of events, the website of Umbrella Properties, a prominent real estate company, has been compromised by hackers, putting a significant amount of sensitive data at risk. The breach raises alarms about the security measures in place to protect critical information and underscores the growing threat of cyberattacks targeting businesses across various sectors. By partnering with the our team, Umbrella Properties can navigate the complexities of cybersecurity with confidence and ensure the continued security and integrity of its digital infrastructure. |
|||||
| Ransomware | UMAPS id13325 View details | Public Sector | |||
|
VIDEO OF FILES PART1 - http://cybertube.video/web/index.html#!/details?id=160b79ab060e136a02e655272228597f&serverId=2be5e68176ff4f8fbb930fe66321ab72 . Youtube videos will be posted, if we will not get the required payment amount . The "Unidad Municipal de Agua Potable y Saneamiento" (Municipal Unit of Potable Water and Sanitation) typically refers to a local government entity responsible for managing the supply of clean drinking water and sanitation services within a municipality or local area. |
|||||
| Ransomware | fidelia-consulting.com id13324 View details | France | Services | ||
|
Fidelia Consulting is an accounting firm based in Nanterre, near Paris. The firm offers a range of services including accounting, payroll management, legal and tax advice, and business creation support. Established in 2010, they focus on personalized client relationships and cater to various sectors such as construction, e-commerce, restaurants, and freelancers. |
|||||
| Ransomware | olympusgrp.com id13323 View details | Communication / Marketing | |||
|
Olympus Group representative (his email [email protected]) break down the deal. Video Proof of our conversation is here - https://streamable.com/7b3hw9 Download video here - https://upload.disroot.org/r/rmycUywF#swFHPxGZ3qihzAskKwG2Hwym9xd0BUMxDjDUpPB57VQ= Even 1 clerk in chain with Chief Justice will easily open the investigation due our file leak and mailing with BCC to clients and assign Supreme Court employee with getting to the bottom of the leak. Source: https://www.newsnationnow.com/politics/reports-law-clerks-among-scotus-leak-suspects/ |
|||||
| Ransomware | umbrellaproperties.com PART2 id12689 View details | United States | Communication / Marketing | ||
|
VIDEO OF FILES PART#1 - http://cybertube.video/web/index.html#!/details?id=782ccbf2b08c75eb63d1d90d23670518&serverId=2be5e68176ff4f8fbb930fe66321ab72 Umbrella Properties offers apartments, duplexes and townhouses for rent in many styles ranging from studios, one-bedroom, two-bedroom, and also three-bedroom units. We offer affordable housing to residents in Eugene, Springfield, Junction City and Bend. In a concerning turn of events, the website of Umbrella Properties, a prominent real estate company, has been compromised by hackers, putting a significant amount of sensitive data at risk. The breach raises alarms about the security measures in place to protect critical information and underscores the growing threat of cyberattacks targeting businesses across various sectors. By partnering with the our team, Umbrella Properties can navigate the complexities of cybersecurity with confidence and ensure the continued security and integrity of its digital infrastructure. |
|||||
| Ransomware | umbrellaproperties.com id12518 View details | United States | Communication / Marketing | ||
|
Umbrella Properties offers apartments, duplexes and townhouses for rent in many styles ranging from studios, one-bedroom, two-bedroom, and also three-bedroom units. We offer affordable housing to residents in Eugene, Springfield, Junction City and Bend. In a concerning turn of events, the website of Umbrella Properties, a prominent real estate company, has been compromised by hackers, putting a significant amount of sensitive data at risk. The breach raises alarms about the security measures in place to protect critical information and underscores the growing threat of cyberattacks targeting businesses across various sectors. By partnering with the our team, Umbrella Properties can navigate the complexities of cybersecurity with confidence and ensure the continued security and integrity of its digital infrastructure. |
|||||
| Ransomware | www.lawdcm.com id12063 View details | United States | Finance / Legal / Insurance | ||
|
Davis Cedillo and Mendoza Inc |
|||||
| Ransomware | www.horizonparts.com id12062 View details | United States | Manufacturing / Engineering | ||
|
Horizon Pool and Spa |
|||||
| Ransomware | insidesource.com id12061 View details | United States | Other | ||
|
Insidesource |
|||||
| Ransomware | leezeragency.com id12060 View details | Communication / Marketing | |||
|
Leezer Agency |
|||||
| Ransomware | welbro.com id12059 View details | United States | Construction / Real Estate | ||
|
WELBRO Building Corporation |
|||||
| Ransomware | yaleappliance.com id12058 View details | United States | Other | ||
|
Yale Appliance |
|||||
| Ransomware | armstrongconsultants.com id12057 View details | United States | Other | ||
|
Armstrong Consultants |
|||||
| Ransomware | ibacos.com id12056 View details | United States | Other | ||
|
IBACOS |
|||||
| Ransomware | petersenjohnson.com id12055 View details | United States | Other | ||
|
Petersen Johnson |
|||||
| Ransomware | www.c-v-e.com id12054 View details | United States | Other | ||
|
Chula Vista Electric (CVE) |
|||||
| Ransomware | www.buymesco.com id12053 View details | United States | Retail / E-commerce | ||
|
Muenz-Engineered Sales |
|||||
| Ransomware | www.webberrestaurantgroup.com id12052 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
WEBBER RESTAURANT GROUP |
|||||
| Ransomware | universalproperties.ca id12051 View details | Canada | Communication / Marketing | ||
|
UNIVERSAL REALTY GROUP |
|||||
| Ransomware | cftvyv.com id12050 View details | Other | |||
|
VVandA |
|||||
| Ransomware | www.fennpest.com id12049 View details | United States | Other | ||
|
Fenn Termite and Pest Control |
|||||
| Ransomware | arietishealth.com id12048 View details | United States | Healthcare / Pharma | ||
|
arietishealth.com |
|||||
| Ransomware | tjx.com id12047 View details | United States | Other | ||
|
tjx.com |
|||||
| Ransomware | pbinfo.com id12046 View details | United States | Other | ||
|
pbinfo.com |
|||||
| Ransomware | mesvision.com id12045 View details | United States | Other | ||
|
mesvision.com |
|||||
| Ransomware | goalsolutions.com id12044 View details | United States | Services | ||
|
goalsolutions.com |
|||||
| Ransomware | gnc.com id12043 View details | United States | Other | ||
|
gnc.com |
|||||
| Ransomware | gensler.com id12042 View details | United States | Other | ||
|
gensler.com |
|||||
| Ransomware | genesisenergy.com id12041 View details | United States | Energy | ||
|
genesisenergy.com |
|||||
| Ransomware | garrettmotion.com id12040 View details | Switzerland | Other | ||
|
garrettmotion.com |
|||||
| Ransomware | fanucamerica.com id12039 View details | United States | Other | ||
|
fanucamerica.com |
|||||
| Ransomware | darlingconsulting.com id12038 View details | United States | Services | ||
|
darlingconsulting.com |
|||||
| Ransomware | chevronfcu.org id12037 View details | United States | Other | ||
|
chevronfcu.org |
|||||
| Ransomware | cap.org id12036 View details | United States | Other | ||
|
cap.org |
|||||
| Ransomware | joneslanglasalle.com id12035 View details | France | Other | ||
|
joneslanglasalle.com |
|||||
| Ransomware | tricoproducts.com id12034 View details | United States | Communication / Marketing | ||
|
tricoproducts.com |
|||||
| Ransomware | enterprisebanking.com id12033 View details | United States | Finance / Legal / Insurance | ||
|
enterprisebanking.com |
|||||
| Ransomware | deltadental.com id12032 View details | United States | Healthcare / Pharma | ||
|
deltadental.com |
|||||
| Ransomware | salelytics.com id12031 View details | United States | Other | ||
|
salelytics.com |
|||||
| Ransomware | adaresec.com id12030 View details | United States | Other | ||
|
adaresec.com |
|||||
| Ransomware | chuckecheese.com id12029 View details | United States | Other | ||
|
chuckecheese.com |
|||||
| Ransomware | deloitte.com id12028 View details | France | Other | ||
|
deloitte.com |
|||||
| Ransomware | wsp.com id12027 View details | France | Other | ||
|
wsp.com |
|||||
| Ransomware | planethomelending.com id12026 View details | United States | Other | ||
|
planethomelending.com |
|||||
| Ransomware | virginpulse.com id12025 View details | United States | Other | ||
|
virginpulse.com |
|||||
| Ransomware | vitalitygroup.com id12024 View details | United Kingdom | Services | ||
|
vitalitygroup.com |
|||||
| Ransomware | hallmarkchannel.com id12023 View details | United States | Other | ||
|
hallmarkchannel.com |
|||||
| Ransomware | hillrom.com id12022 View details | France | Other | ||
|
hillrom.com |
|||||
| Ransomware | pro2col.com id12021 View details | United Kingdom | Communication / Marketing | ||
|
pro2col.com |
|||||
| Ransomware | orau.org id12020 View details | United States | Other | ||
|
orau.org |
|||||
| Ransomware | aclara.com id12019 View details | United States | Other | ||
|
aclara.com |
|||||
| Ransomware | quark.com id12018 View details | France | Other | ||
|
quark.com |
|||||
| Ransomware | convergeone.com id12017 View details | United States | Other | ||
|
convergeone.com |
|||||
| Ransomware | amerisave.com id12016 View details | United States | Other | ||
|
amerisave.com |
|||||
| Ransomware | kellyservices.com id12015 View details | United States | Services | ||
|
kellyservices.com |
|||||
| Ransomware | hubbell.com id12014 View details | United States | Other | ||
|
hubbell.com |
|||||
| Ransomware | dma.us id12013 View details | United States | Other | ||
|
dma.us |
|||||
| Ransomware | ventivtech.com id12012 View details | United Kingdom | IT | ||
|
ventivtech.com |
|||||
| Ransomware | bluefin.com id12011 View details | Other | |||
|
bluefin.com |
|||||
| Ransomware | esteelauder.com id12010 View details | United States | Manufacturing / Engineering | ||
|
esteelauder.com |
|||||
| Ransomware | itt.com id12009 View details | Other | |||
|
itt.com |
|||||
| Ransomware | aa.com id12008 View details | United States | Other | ||
|
aa.com |
|||||
| Ransomware | rci.com id12007 View details | Other | |||
|
rci.com |
|||||
| Ransomware | notablefrontier.com id12006 View details | Other | |||
|
notablefrontier.com |
|||||
| Ransomware | grace.com id12005 View details | Other | |||
|
grace.com |
|||||
| Ransomware | hess.com id12004 View details | Other | |||
|
hess.com |
|||||
| Ransomware | pinnacletpa.com id12003 View details | Other | |||
|
pinnacletpa.com |
|||||
| Ransomware | gripa.org id12002 View details | Other | |||
|
gripa.org |
|||||
| Ransomware | ufcu.org id12001 View details | Other | |||
|
ufcu.org |
|||||
| Ransomware | discovery.com id12000 View details | Other | |||
|
discovery.com |
|||||
| Ransomware | motherson.com id11999 View details | Other | |||
|
motherson.com |
|||||
| Ransomware | amctheatres.com id11998 View details | Other | |||
|
amctheatres.com |
|||||
| Ransomware | marykay.com id11997 View details | Other | |||
|
marykay.com |
|||||
| Ransomware | cytomx.com id11996 View details | Other | |||
|
cytomx.com |
|||||
| Ransomware | americannational.com id11995 View details | Other | |||
|
americannational.com |
|||||
| Ransomware | bcdtravel.com id11994 View details | Transportation / Travel / Logistics | |||
|
bcdtravel.com |
|||||
| Ransomware | jprmp.com id11993 View details | Communication / Marketing | |||
|
jprmp.com |
|||||
| Ransomware | fmfcu.org id11992 View details | Other | |||
|
fmfcu.org |
|||||
| Ransomware | jackentertainment.com id11991 View details | Other | |||
|
jackentertainment.com |
|||||
| Ransomware | nasco.com id11990 View details | Other | |||
|
nasco.com |
|||||
| Ransomware | radiusgs.com id11989 View details | Other | |||
|
radiusgs.com |
|||||
| Ransomware | consolenergy.com id11988 View details | Energy | |||
|
consolenergy.com |
|||||
| Ransomware | sccu.com id11987 View details | Other | |||
|
sccu.com |
|||||
| Ransomware | riteaid.com id11986 View details | Other | |||
|
riteaid.com |
|||||
| Ransomware | pioneerelectronics.com id11985 View details | Other | |||
|
pioneerelectronics.com |
|||||
| Ransomware | fiscdp.com id11984 View details | Other | |||
|
fiscdp.com |
|||||
| Ransomware | kernagency.com id11983 View details | Communication / Marketing | |||
|
kernagency.com |
|||||
| Ransomware | uoflhealth.org id11982 View details | India | Healthcare / Pharma | ||
|
uoflhealth.org |
|||||
| Ransomware | wolterskluwer.com id11981 View details | Other | |||
|
wolterskluwer.com |
|||||