Ransomware Group intelligence
Eclipse
ActiveTrack Eclipse with 11 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Eclipse is tracked by Breach House as a ransomware group with 11 published victims.
Singapore is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Leak Status Distribution
11
- Leaked 10 90.9%
- Pending 1 9.1%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 2 | Onion service | Up checked 15h ago | yecdjimqiaekprxza6wkqecma4bwt757qiyfjngsaxg7rkjv4xukpwad.onion |
| Leak location 1 | Onion service | Up checked 15h ago | eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion |
Top Activity Sectors (8)
Typical Attacks (7)
▼MITRE ATT&CK does not currently catalogue Eclipse, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Eclipse executes malicious payloads via PowerShell scripts to deploy ransomware and evade detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Eclipse disables security tools like antivirus software to prevent system recovery and hinder incident response.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Eclipse deletes Volume Shadow Copies and backup files via vssadmin to eliminate recovery options.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: Eclipse uses file and directory discovery to locate sensitive data and backup locations for targeting.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1560.001 Archive via Utility Collection
What they do: Eclipse archives victim data using utility tools prior to encryption to facilitate potential exfiltration.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: Eclipse encrypts victim files using strong symmetric encryption to maximize impact and ransom demand.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Eclipse inhibits system recovery by corrupting critical services and disabling restore mechanisms.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (11)
Search, filter and paginate the victim timeline for Eclipse. Showing 1–11 of 11.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | The Japan Times id33357 View details | Japan | Services | pending | ||
|
The Japan Times is a leading English-language news outlet that provides comprehensive coverage of Japan's business, politics, culture, sports, and entertainment. It offers various subscription options, including digital and print formats, catering to a diverse audience interested in Japanese news and insights. The company also features specialized services such as academic and business subscriptions, as well as access to its digital archives. Its intended clients include local and international readers seeking reliable information about Japan and its global interactions. |
||||||
| Ransomware | Dublin City Schools GA id32815 View details | United States | Education | leaked | ||
|
Dublin City Schools is a charter school system dedicated to preparing students to be effective communicators, problem solvers, and lifelong learners. The district offers a range of academic programs, including advanced and gifted education, special education, and various support services. Their intended clients include students and families in Dublin, Georgia, as well as educators seeking employment opportunities within the district |
||||||
| Ransomware | Rosello et Fils id32814 View details | France | Hospitality / Food & Beverage / Tourism | leaked | ||
|
Rosello & Fils is a fruit and vegetable wholesaler based in Saint-Laurent-Blangy, France. With over 100 years of experience, the company operates exclusively within the Hauts-de-France region, serving professionals in the Nord, Pas-de-Calais, and Somme departments. Its client base includes commercial and collective catering, local shops, and large and medium-sized retail surfaces |
||||||
| Ransomware | The Zhou Law Group id32679 View details | United States | Finance / Legal / Insurance | leaked | ||
|
The Zhou Law Group is one of the largest family law firms in California, specializing in divorce and related family law issues such as child custody, spousal support, and property division. With a team of top-rated divorce lawyers and Certified Family Law Specialists, they provide effective legal solutions to clients, including tech company founders and high asset-holders. The firm operates in the Greater Bay Area and Greater Los Angeles, offering services in multiple languages, including English and Chinese. Their reputation for professionalism and client care has earned them stellar reviews and a strong presence in the family law industry. |
||||||
| Ransomware | TTG Asia Media id32680 View details | Singapore | Retail / E-commerce | leaked | ||
|
TTG Asia is a leading travel trade business resource in the Asia-Pacific region, established in 1974. The company provides a comprehensive range of services and information related to travel, including hotels, transportation, airlines, and cruises. Its intended clients include travel professionals and businesses within the tourism industry looking for insights and resources to enhance their operations. TTG Asia also features news, trade calendars, and branded content to support the growth of the travel sector. |
||||||
| Ransomware | part1.simplexengg.in id32419 View details | India | Manufacturing / Engineering | leaked | ||
|
[AI generated] N/A |
||||||
| Ransomware | Royal Plaza On Scotts id32416 View details | Singapore | Retail / E-commerce | leaked | ||
|
Royal Plaza on Scotts Hotel is a five-star independent hotel located in the heart of Singapore's Orchard Road, offering spacious and modern accommodations. With a legacy of over 50 years, it has been recognized as Asia Pacific's Best Independent Hotel, providing guests with a comfortable stay and award-winning halal-certified dining at its renowned Carousel restaurant. The hotel caters to both leisure and business travelers, featuring facilities for meetings, events, and weddings. Guests can enjoy exclusive offers and loyalty rewards through the I Prefer Hotel Rewards Programme. |
||||||
| Ransomware | ETNA Software id32217 View details | Italy | IT | leaked | ||
|
ETNA Software is a company that provides white-label online trading solutions for brokers and FinTech firms, including mobile and web trading platforms. Their products are designed to help retail broker-dealers launch trading capabilities efficiently and cost-effectively. |
||||||
| Ransomware | Simplex Engineering id32166 View details | India | Manufacturing / Engineering | leaked | ||
|
Simplex Engineering & Foundry Works Pvt. Ltd. specializes in the design, fabrication, machining, and assembly of industrial equipment and components. With over seventy years of experience, the company has successfully completed numerous turnkey projects for both private and public sector organizations. Additionally, Simplex offers refurbishment services for industrial equipment and steel procurement through its Steel Service Center. Their esteemed clientele includes some of the largest engineering companies in India. |
||||||
| Ransomware | Crystal Pharmatech id32021 View details | United States | Healthcare / Pharma | leaked | ||
|
Crystal Pharmatech is a technology-driven contract research organization (CRO) that focuses on materials science and engineering for drug development. Established in 2010 and have R&D centers located in Suzhou (China), New Jersey, San Francisco (USA), and Toronto (Canada). Also its key differentiator is integrated and specialized services, including API solid-state research, crystallization, preformulation, formulation development and manufacturing, clinical supply. |
||||||
| Ransomware | Moscord id31775 View details | Singapore | IT | leaked | ||
|
Moscord is a digital marketplace that connects buyers and sellers in the maritime industry, offering a platform for various suppliers to aggregate and present their products. The company aims to enhance business operations for its clients by providing innovative solutions in procurement, logistics, and eCommerce. Targeting maritime and oil & gas sectors, Moscord serves a global clientele through its extensive network of ports and offices across multiple countries. With a focus on improving user experience and operational efficiency, Moscord leverages advanced technology and industry expertise to facilitate seamless transactions. |
||||||