Ransomware Group intelligence
Genesis
ActiveTrack Genesis with 140 published victims and 1 known leak locations in a single intelligence view.
Overview
Genesis is tracked by Breach House as a ransomware group with 140 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 55m ago | genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion |
Top Activity Sectors (15)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Genesis, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: genesis executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: genesis adds malicious registry run keys to ensure persistence across reboots on infected endpoints.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: genesis disables antivirus tools by terminating security processes and modifying Windows Defender settings via registry edits.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: genesis deletes Volume Shadow Copies and backup directories via vssadmin commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: genesis discovers remote systems via SMB enumeration to map the victim organization's network topology.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: genesis scans network shares using net use commands to identify valuable files for encryption and exfiltration targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: genesis moves laterally through SMB shares to compromise additional servers within the same network segment.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1041 Exfiltration Over C2 Channel Exfiltration
What they do: genesis exfiltrates stolen data through encrypted C2 channels before deploying ransomware on critical assets.
What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: genesis encrypts victim files using a custom symmetric encryption routine, targeting finance and legal documents first.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: genesis triggers system shutdown commands and service termination to maximize disruption during impact phase.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (140)
Search, filter and paginate the victim timeline for Genesis. Showing 1–100 of 140.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | S******* id32100 View details | — | |||
|
The entity . represents a ransomware victim within the threat-intelligence index. Its sector and specific offerings remain unspecified in the provided data, so this description relies solely on its classification as a victim entity associated with the Genesis threat actor. Genesis is documented as the associated threat actor or source linked to this listing type. This entry catalogs the relationship between the entity and the threat actor without attributing confirmed incident details, breach specifics, or operational intelligence. The description maintains neutrality per catalog standards, focusing on the entity's role as a ransomware victim tied to Genesis. |
|||||
| Ransomware | S******* id32100 View details | — | |||
|
An International Public Company |
|||||
| Ransomware | Hospitality Health ER (Longview) id32060 View details | United States | — | ||
|
This entity represents a ransomware victim organization located within the United States. Operating within its designated sector, the entity has been identified and cataloged within the threat-intelligence index due to its connection to the Genesis threat actor. The Genesis group is recognized in cybersecurity intelligence as an active ransomware campaign associated with targeting organizations and deploying malicious payloads. This listing type formally records the entity's status as a victim of this specific threat actor, contributing valuable contextual data for monitoring and threat-response efforts. The catalog entry maintains an objective record of this association for analytical purposes. |
|||||
| Ransomware | Hospitality Health ER (Longview) id32060 View details | United States | — | ||
|
A healthcare organization |
|||||
| Ransomware | **E*** id31574 View details | United States | Other | ||
|
The company is a US based entity operating in the other sector, providing various offerings to its customers. It is located in the US and serves a specific market. The company was listed as a ransomware victim associated with genesis. |
|||||
| Ransomware | **E*** id31574 View details | United States | Other | ||
|
A healthcare organization |
|||||
| Ransomware | Interim HealthCare id31552 View details | United States | Healthcare / Pharma | ||
|
Interim Healthcare is a US-based healthcare company that provides medical services and support to patients across the country. The company operates in the healthcare and medicine sector, offering a range of services including home care, hospice care, and medical staffing. Interim Healthcare was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Interim HealthCare id31552 View details | United States | Healthcare / Pharma | ||
|
A healthcare organization dealing with elderly care services |
|||||
| Ransomware | Consolidated Medical Practices of Memphis id31545 View details | United States | Other | ||
|
The entity operates in the Other sector in the US, providing various offerings to its customers. As a company in this sector, it plays a role in the US economy. It was listed as a ransomware victim associated with genesis. |
|||||
| Ransomware | Consolidated Medical Practices of Memphis id31545 View details | United States | Other | ||
|
A healthcare organization |
|||||
| Ransomware | Interim HealthCare (Oklahoma and Tulsa) id31546 View details | United States | Healthcare / Pharma | ||
|
Interim Healthcare is a US-based healthcare company that provides medical services and support to patients across the country. The company operates in the healthcare sector, offering a range of services including home healthcare, hospice care, and medical staffing. Interim Healthcare was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Interim HealthCare (Oklahoma and Tulsa) id31546 View details | United States | Healthcare / Pharma | ||
|
A healthcare organization dealing with elderly care services |
|||||
| Ransomware | **** id31083 View details | United States | Other | ||
|
The entity is a US-based organization operating in the other sector, providing various offerings to its customers. Located in the United States, it is part of a diverse range of industries. It was listed as a ransomware victim associated with genesis. |
|||||
| Ransomware | **** id31083 View details | United States | Other | ||
|
A healthcare organization |
|||||
| Ransomware | Boyum IT Solutions (HOT!) id31072 View details | Denmark | IT | ||
|
Boyum-it.com is a Denmark-based IT company that provides various IT services and solutions. The company operates in the IT sector, offering its services to clients in Denmark and potentially other countries. Boyum-it.com was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Boyum IT Solutions (HOT!) id31072 View details | Denmark | IT | ||
|
A provider of IT services |
|||||
| Ransomware | C.A. Walker Construction id31073 View details | United States | Construction / Real Estate | ||
|
CA Walker Construction is a US-based company operating in the construction and real estate sector, providing various services. The company is involved in construction projects, offering services to clients in the United States. CA Walker Construction was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | C.A. Walker Construction id31073 View details | United States | Construction / Real Estate | ||
|
A construction management company |
|||||
| Ransomware | Williams Accounting Professional id30938 View details | Canada | Finance / Legal / Insurance | ||
|
Bramptondirect.ca is a Canadian company operating in the finance, legal, and insurance sector, providing various services to its clients. The company is based in Canada and offers a range of financial and insurance products. Bramptondirect.ca was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Williams Accounting Professional id30938 View details | Canada | Finance / Legal / Insurance | ||
|
A full service CPA firm |
|||||
| Ransomware | JJP Slip Forming Inc. id30939 View details | United States | Other | ||
|
The entity is a US-based organization operating in the other sector, providing various offerings to its customers. Located in the US, the entity serves a diverse range of clients. It was listed as a ransomware victim associated with genesis. |
|||||
| Ransomware | JJP Slip Forming Inc. id30939 View details | United States | Other | ||
|
A company that operates in the Restaurants industry |
|||||
| Ransomware | Building Envelope Systems id30940 View details | United States | Manufacturing / Engineering | ||
|
Infinity Pipe Inc is a US-based company operating in the manufacturing and engineering sector, providing various products and services. The company is involved in the production and distribution of pipes and related engineering solutions. Infinity Pipe Inc was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Building Envelope Systems id30940 View details | United States | Manufacturing / Engineering | ||
|
A reputable construction company based in Plainville, MA |
|||||
| Ransomware | Westlake Realty Group, Inc. id30941 View details | United States | Construction / Real Estate | ||
|
Westlake Realty is a US-based company operating in the construction and real estate sector, providing various services related to property development and management. The company is involved in multiple aspects of the real estate industry, including construction, property management, and sales. Westlake Realty is listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Westlake Realty Group, Inc. id30941 View details | United States | Construction / Real Estate | ||
|
A full-service real estate development company |
|||||
| Ransomware | Servonix Technologies id30942 View details | United States | IT | ||
|
Servonix.com is an IT company based in the United States, offering various IT services. The company operates in the IT sector, providing solutions to its clients. Servonix.com was listed as a ransomware victim associated with genesis |
|||||
| Ransomware | Servonix Technologies id30942 View details | United States | IT | ||
|
A provider of IT services |
|||||
| Ransomware | Infinity Pipeline,Inc. id30943 View details | United States | Manufacturing / Engineering | ||
|
Infinity Pipe Inc is a manufacturing and engineering company based in the United States, offering various products and services to its clients. The company operates in the manufacturing and engineering sector, providing solutions to its customers. Infinity Pipe Inc was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Infinity Pipeline,Inc. id30943 View details | United States | Manufacturing / Engineering | ||
|
A family owned, local construction company. |
|||||
| Ransomware | Apex Agro, LLC id30258 View details | United States | Agriculture / Food | ||
|
Apexagchem.com is an entity operating in the agriculture and food sector in the United States, likely providing chemical products or services. The company's specific offerings and operations are not well-documented, but its name suggests a focus on agricultural chemicals. Apexagchem.com was listed as a ransomware victim associated with genesis |
|||||
| Ransomware | Apex Agro, LLC id30258 View details | United States | Agriculture / Food | ||
|
A Chemical Production Company |
|||||
| Ransomware | Mirage Endoscopy Center id30259 View details | United States | Healthcare / Pharma | ||
|
Mirage Endoscopy Center is a healthcare facility in the US, offering medical services, specifically in the field of endoscopy. As a healthcare provider, it plays a crucial role in the medical sector. Mirage Endoscopy Center was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Mirage Endoscopy Center id30259 View details | United States | Healthcare / Pharma | ||
|
A healthcare organization |
|||||
| Ransomware | Bri-Tech, Inc id30260 View details | United States | IT | ||
|
Bri-tech.com is an IT company based in the United States, providing various services within the IT sector. As a US-based entity, bri-tech.com operates within the IT industry, offering services to its clients. Bri-tech.com was listed as a ransomware victim associated with genesis |
|||||
| Ransomware | Bri-Tech, Inc id30260 View details | United States | IT | ||
|
A technology design and integration firm |
|||||
| Ransomware | SBI Software id30261 View details | United States | Agriculture / Food | ||
|
Sbigrower.com is an entity operating in the agriculture and food sector in the United States. The company likely provides various services related to agricultural growth and food production. Sbigrower.com was listed as a ransomware victim associated with genesis. |
|||||
| Ransomware | SBI Software id30261 View details | United States | Agriculture / Food | ||
|
An Enterprise Resource Planning Software Provider |
|||||
| Ransomware | DICON id30262 View details | United States | IT | ||
|
Dicon.com is an IT company based in the United States, providing various services to its clients. As an IT sector entity, dicon.com likely offers a range of technology-related solutions. Dicon.com was listed as a ransomware victim associated with genesis |
|||||
| Ransomware | DICON id30262 View details | United States | IT | ||
|
A general contracting construction firm |
|||||
| Ransomware | Westgate id30263 View details | United States | Construction / Real Estate | ||
|
Westgate LLC is a company operating in the construction and real estate sector in the United States. The company likely provides various services related to construction and real estate development. Westgate LLC was listed as a ransomware victim associated with Genesis |
|||||
| Ransomware | Westgate id30263 View details | United States | Construction / Real Estate | ||
|
A construction management company |
|||||
| Ransomware | Dunagan Associates id30264 View details | United States | Finance / Legal / Insurance | ||
|
Dunagan Associates is a US-based company operating in the finance, legal, and insurance sectors, providing various services to its clients. The company is headquartered in the United States and offers a range of financial and insurance solutions. Dunagan Associates was listed as a ransomware victim associated with Genesis. |
|||||
| Ransomware | Dunagan Associates id30264 View details | United States | Finance / Legal / Insurance | ||
|
Provides services in residential real estate and insurance |
|||||
| Ransomware | Synergy Interactive id30265 View details | United States | IT | ||
|
Sinyc.com operates within the IT sector in the United States, providing various services. As an IT company, sinyc.com likely offers solutions and support to its clients. Sinyc.com was listed as a ransomware victim associated with genesis |
|||||
| Ransomware | Synergy Interactive id30265 View details | United States | IT | ||
|
A provider of staffing services |
|||||
| Ransomware | East Texas Family Medicine id30266 View details | United States | Healthcare / Pharma | ||
|
etfmed.com is a US-based entity operating in the healthcare and medicine sector, providing medical services and solutions. The company is located in the United States and offers various medical services to its clients. etfmed.com was listed as a ransomware victim associated with genesis |
|||||
| Ransomware | East Texas Family Medicine id30266 View details | United States | Healthcare / Pharma | ||
|
A healthcare organization |
|||||
| Ransomware | Brooklyn Defender Services id30134 View details | United States | Other | ||
|
The company operates in the other sector in the US, providing various offerings to its customers. As a part of this sector, the company plays a role in the US economy. It was listed as a ransomware victim associated with genesis. |
|||||
| Ransomware | Brooklyn Defender Services id30134 View details | United States | Other | ||
|
A legal organization dedicated to safeguard the rights of its clients |
|||||
| Ransomware | United Personnel (a division of Masis Staffing Solutions) id29969 View details | United States | Services | ||
|
A provider of staffing services |
|||||
| Ransomware | The Associated Builders and Contractors of Indiana/Kentucky id29970 View details | United States | NGOs / Associations | ||
|
A trade association |
|||||
| Ransomware | *B* id29659 View details | United States | Construction / Real Estate | ||
|
A trade association |
|||||
| Ransomware | PB White & Co id29594 View details | Other | |||
|
A provider of financial services |
|||||
| Ransomware | Family Medical Associates of Raleigh id29595 View details | United States | Other | ||
|
A healthcare organization |
|||||
| Ransomware | Cavalier Flooring Systems Inc. id29369 View details | United States | Construction / Real Estate | ||
|
A flooring and tile contractor |
|||||
| Ransomware | Wentworth id29370 View details | United States | Other | ||
|
the DC Metro area's premier design-build firm |
|||||
| Ransomware | Green Resource id29371 View details | United States | Manufacturing / Engineering | ||
|
A leading distributor of professional fertilizers, chemicals, and seeds for local and lawn grasses |
|||||
| Ransomware | Cedar Street Capital (A part of a Cynvestors Limited Partnership) id29372 View details | United States | Finance / Legal / Insurance | ||
|
A private investment entity associated with Cynthia Stiehl |
|||||
| Ransomware | A Roettgers id29373 View details | United States | Retail / E-commerce | ||
|
Fuel distributor and gas station operator |
|||||
| Ransomware | *M** id29393 View details | United States | Healthcare / Pharma | ||
|
A healthcare organization |
|||||
| Ransomware | ******** & Co id29394 View details | United States | Finance / Legal / Insurance | ||
|
A provider of financial services |
|||||
| Ransomware | Peña & Bromberg id29412 View details | United States | Finance / Legal / Insurance | ||
|
A legal firm dedicated to safeguard the rights of its clients |
|||||
| Ransomware | **** & ******** id29327 View details | United States | Finance / Legal / Insurance | ||
|
A legal firm dedicated to safeguard the rights of its clients |
|||||
| Ransomware | Pequod Associates id29077 View details | United States | Services | ||
|
A global leader in the provision of Marine Claims TPA and Recovery services. |
|||||
| Ransomware | Casino Gaming Commission id29065 View details | Jamaica | Public Sector | ||
|
Official Casino Gaming Commission of Jamaica. |
|||||
| Ransomware | Fargo Moorhead West Fargo Chamber id29066 View details | United States | Services | ||
|
A business services provider. |
|||||
| Ransomware | Integrated Process Engineers & Constructors. id29067 View details | United States | Other | ||
|
Specializes in custom modular process systems, offering a wide range of products including bioreactors, filtration systems, and utility stations. |
|||||
| Ransomware | Ben F. Barcus and associates pllc id29068 View details | United States | Finance / Legal / Insurance | ||
|
A law firm from Tacoma, WA. |
|||||
| Ransomware | Palo id29069 View details | United States | Construction / Real Estate | ||
|
Architecture and Planning. |
|||||
| Ransomware | HostBooks (HOT!) id29070 View details | United States | Finance / Legal / Insurance | ||
|
An accounting software provider. |
|||||
| Ransomware | CarePoint Health id28979 View details | Canada | Healthcare / Pharma | ||
|
CarePoint Health will provide all patients of the company's affiliated physicians who would benefit from team based care. |
|||||
| Ransomware | The American Board of Preventive Medicine id28980 View details | United States | Healthcare / Pharma | ||
|
A healthcare certification organization. |
|||||
| Ransomware | Prescott & Holden id28981 View details | United States | Finance / Legal / Insurance | ||
|
A legal firm dedicated to safeguard the rights of its clients |
|||||
| Ransomware | Van Atta Engineering id28982 View details | United States | Construction / Real Estate | ||
|
A civil engineering and surveying firm located at 570 Congress Park Dr, Dayton, Ohio. |
|||||
| Ransomware | Rain Makers Solutions id28983 View details | United States | Services | ||
|
Conducting training sessions, engaging with stakeholders, and organizing meetings and events. |
|||||
| Ransomware | K2 Electric, Inc id28697 View details | United States | Construction / Real Estate | ||
|
Commercial and industrial electrical contractor. |
|||||
| Ransomware | *** id28277 View details | Other | |||
|
A healthcare organization |
|||||
| Ransomware | Catalyst Learning Company id27782 View details | United States | Education | ||
|
Specializes in healthcare training and employee development, aiming to empower staff for better patient outcomes and organizational success. |
|||||
| Ransomware | B&R Sheet Metal id27781 View details | United States | Manufacturing / Engineering | ||
|
Specializes in industrial construction projects, offering design, fabrication, and installation services for pneumatic, mechanical conveying, and filtration systems |
|||||
| Ransomware | Raphael Ortho id27780 View details | United States | Healthcare / Pharma | ||
|
A Dental Practice Management Company. |
|||||
| Ransomware | Green Giftz id27779 View details | United States | Communication / Marketing | ||
|
A certified branded merchandise agency based. |
|||||
| Ransomware | HMI Elements id27778 View details | United Kingdom | Manufacturing / Engineering | ||
|
The production of reliable human-machine interfaces (HMIs) designed for use in hazardous environments |
|||||
| Ransomware | MC-Rx id27777 View details | United States | Healthcare / Pharma | ||
|
Formerly MC-21 and ProCare PBM |
|||||
| Ransomware | Modern Advanced Print Solutions (MAPS, Inc.) id27776 View details | United States | Services | ||
|
Modern Advanced Print Solutions (MAPS, Inc.). |
|||||
| Ransomware | Secure Health id27775 View details | United States | Agriculture / Food | ||
|
Provides administrative, care management, and healthy lifestyle services to employers with self-funded, group health care plans |
|||||
| Ransomware | ***** ***** & ****** id27396 View details | United States | Finance / Legal / Insurance | ||
|
Law Firms & Legal Services · South Carolina, United States |
|||||
| Ransomware | Griswold Controls id27172 View details | United States | IT | ||
|
A leader in flow control technology and valves, specializing in HVAC and irrigation applications |
|||||
| Ransomware | NADAP id27171 View details | United States | NGOs / Associations | ||
|
A non-profit organization |
|||||
| Ransomware | City of Hart id27170 View details | United States | Public Sector | ||
|
A City of Hart local municipal organization |
|||||
| Ransomware | Brighton Eye id27169 View details | United States | Other | ||
|
An eye care center in Brooklyn, NY |
|||||
| Ransomware | Cornerstone Financial Advisors, INC id27168 View details | United States | Finance / Legal / Insurance | ||
|
A full service CPA firm |
|||||
| Ransomware | Sanders Legal Group id27167 View details | United States | Finance / Legal / Insurance | ||
|
A law firm based in Atlanta, Georgia |
|||||
| Ransomware | OneSource Medical Group id27166 View details | United States | Healthcare / Pharma | ||
|
A provider of RCM and billing services |
|||||
| Ransomware | Sierra Management Group id27165 View details | United States | Services | ||
|
Provides comprehensive medical practice management |
|||||
| Ransomware | Community Health Action of Staten Island (A part of Sun River Health) id26628 View details | United States | Healthcare / Pharma | ||
|
An interesting non-profit organization |
|||||
| Ransomware | Stockton Cardiology Medical Group id26627 View details | United States | Healthcare / Pharma | ||
|
A provider of cardiology services. |
|||||
| Ransomware | Community Management Associates id26626 View details | United States | Services | ||
|
Serves residential and master-planned communities, town homes, mixed use and commercial/retail properties. |
|||||
| Ransomware | Robeck Fluid Power id26625 View details | United States | Energy | ||
|
A supplier of machinery solutions |
|||||
| Ransomware | Fong Ilagan, LLP id26624 View details | United States | Finance / Legal / Insurance | ||
|
An immigration law firm from Texas, USA. |
|||||