Ransomware Group intelligence
Insane
InactiveTrack Insane with 1 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Insane is tracked by Breach House as a ransomware group with 1 published victims.
Thailand is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Down checked 4h ago | r2ad4ayrgpf7og673lhrw5oqyvqg4em2fpialk7l7gxkasvqkqow4qad.onion |
| Leak location 1 | Onion service | Down checked 4h ago | nv5lbsrr4rxmewzmpe25nnalowe4ga7ki6yfvit3wlpu7dfc36pyh4ad.onion |
| Leak location 2 | Onion service | Down checked 4h ago | gfksiwpsqudibondm6o2ipxymaonehq3l26qpgqr3nh4jvcyayvogcid.onion |
Top Activity Sectors (1)
Typical Attacks (7)
▼MITRE ATT&CK does not currently catalogue Insane, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: low. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: insane executes commands via PowerShell scripts to automate system access and payload deployment.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: insane disables security tools like antivirus software to evade detection during ransomware activity.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.016 Junk Code Insertion Stealth
What they do: insane inserts junk code into legitimate binaries to hinder analysis and detection of its malware.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1057 Process Discovery Discovery
What they do: insane discovers running processes to identify services and processes to disable or encrypt.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1485 Data Destruction Impact
What they do: insane destroys data volumes and backups to maximize impact and pressure victims into paying ransom.
What that means: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
-
T1486 Data Encrypted for Impact Impact
What they do: insane encrypts victim files using its ransomware payload to hold data hostage for ransom.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: insane stops critical services and processes to disrupt victim operations before encryption.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
Victims (1)
Search, filter and paginate the victim timeline for Insane. Showing 1–1 of 1.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | JspPharma id10448 View details | Thailand | Healthcare / Pharma | ||
|
A few words about the breached company: JSP Pharmaceutical Manufacturing (Thailand) PCL is engaged in Researching, Developing and producing drugs, dietary supplements, cosmetics, herbs, and dietary supplements in the form of vitamins including healthy coffee Ready.Its segments include Manufacturing and distribution of products under the customer's Brand name and Own Brand name.The majority of the revenue comes from the manufacturing and distribution of products under the customer's brand name.The Group is managed and operates principally in Thailand. |
|||||