Ransomware Group intelligence
Insomnia
ActiveTrack Insomnia with 53 published victims and 1 known leak locations in a single intelligence view.
Overview
Insomnia is tracked by Breach House as a ransomware group with 53 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 3h ago | i62huw7ve22rpyw6lnq3kmfump2dmsg4xpveec3ere73njwatrz74gad.onion |
Top Activity Sectors (13)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Insomnia, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Insomnia executes PowerShell scripts to stage payloads and manipulate system processes during initial compromise.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: Insomnia leverages registry run keys to maintain persistence across reboots for recurring payload execution.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Insomnia disables antivirus tools and security software to prevent detection and hinder recovery efforts.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Insomnia deletes Volume Shadow Copies and backup directories via command-line tools to eliminate recovery options.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: Insomnia dumps LSASS memory to steal credentials for lateral movement into healthcare and finance environments.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: Insomnia scans network shares to identify victim file directories for targeted encryption operations.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Insomnia moves laterally through SMB shares to encrypt files across networked medical and manufacturing systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: Insomnia exfiltrates stolen patient records and proprietary pharmaceutical data before deployment for extortion.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: Insomnia encrypts critical patient and operational files using custom ransomware binaries to maximize impact.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: Insomnia halts critical healthcare services and system recovery processes to disrupt clinical operations.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (53)
Search, filter and paginate the victim timeline for Insomnia. Showing 1–53 of 53.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | Metro Tulsa Foot id32344 View details | United States | Retail / E-commerce | ||
|
www.tulsafoot.com operates within the US Retail and E-commerce sector, providing digital commerce services and customer engagement platforms typical of modern retail enterprises. The entity has been formally cataloged within this threat-intelligence index under the listing type ransomware victim. Its association with the Insomnia threat actor highlights the persistent cybersecurity risks facing retail and e-commerce organizations globally. This entry documents the verified linkage for analytical and defensive reference purposes. The listing neutrally confirms www.tulsafoot.com was listed as a ransomware victim associated with insomnia. |
|||||
| Ransomware | Metro Tulsa Foot id32344 View details | United States | Retail / E-commerce | ||
|
A comprehensive foot and ankle treatment center with five locations in the Tulsa Metro area. They offer a range of services including treatment for common foot pains, deformities, and injuries, and provide same-day appointments for urgent needs. |
|||||
| Ransomware | Aurora Health Management id31887 View details | United States | — | ||
|
Aurora Health Management, LLC operates a skilled nursing and rehab center in Frederick, MD. With nearly 25 years in long-term care, it improves troubled facilities through comprehensive management, programs, and Medicare/Medicaid standards. |
|||||
| Ransomware | *********** id31888 View details | United States | — | ||
|
A private company offering fluid system solutions for the oil, gas, chemical, and semiconductor sectors. It employs 3,600+ people across 10 factories, three tech centers, and about 100 sales and service locations in 50 different countries. |
|||||
| Ransomware | Codinter id31804 View details | United States | — | ||
|
Private company supplying welding, cutting, finishing products and services across North/Central/South America. Offers equipment, tools, accessories, consumables - from mobile units to robotic systems. Oil industry: pipeline, tanks, refinery, platforms. |
|||||
| Ransomware | Park Place Behavioral Health Care id31378 View details | United States | NGOs / Associations | ||
|
The Planned Parenthood Book By Hook organization, or PPBH, is a US-based non-governmental organization operating in the NGOs and associations sector. PPBH provides various offerings to support its mission. It was listed as a ransomware victim associated with insomnia. |
|||||
| Ransomware | Park Place Behavioral Health Care id31378 View details | United States | NGOs / Associations | ||
|
PPBHC provides mental health and substance use services in Osceola County, Florida, with 40+ years’ experience. They offer crisis intervention, therapy, recovery-oriented care, telehealth, and partner with GENOA for medication access. |
|||||
| Ransomware | Merritt Woodwork id31117 View details | United States | Manufacturing / Engineering | ||
|
Merritt Woodwork is a US-based company operating in the manufacturing and engineering sector, providing woodwork services. The company is involved in various manufacturing activities. Merritt Woodwork was listed as a ransomware victim associated with insomnia. |
|||||
| Ransomware | Merritt Woodwork id31117 View details | United States | Manufacturing / Engineering | ||
|
Merritt provides strategic interior solutions for global estates and superyachts, from concept to execution. With precision planning and careful craftsmanship, it partners with top designers and craftsmen to deliver unparalleled results for generations. |
|||||
| Ransomware | Laempe Reich id31118 View details | United States | Retail / E-commerce | ||
|
La Empereich is a retail and e-commerce company based in the United States, offering various products and services to its customers. The company operates in the retail sector, providing online shopping experiences. La Empereich was listed as a ransomware victim associated with insomnia |
|||||
| Ransomware | Laempe Reich id31118 View details | United States | Retail / E-commerce | ||
|
Laempe Reich is North America’s leading foundry core machine supplier, providing sand core equipment and technology for metal casting. As partner of Laempe Mössner Sinto, it serves the industry for over 80 years. |
|||||
| Ransomware | Sky Solutions id31027 View details | Panama | IT | ||
|
Skysolutions.com.pa is an IT company based in Panama, offering various IT services. The company operates in the IT sector, providing solutions to clients in Panama. Skysolutions.com.pa was listed as a ransomware victim associated with insomnia |
|||||
| Ransomware | Sky Solutions id31027 View details | Panama | IT | ||
|
Sky Solutions is a leading distribution company for Telecommunication products and services in Panamá. Currently serving 4 regions in Panama covering +4,000 points of sales; retail chains and supermarkets. |
|||||
| Ransomware | Brooklyn Defender Services id30828 View details | United States | NGOs / Associations | ||
|
The Boycott, Divestment and Sanctions movement, known as BDS, is a US-based non-governmental organization that advocates for Palestinian rights. BDS.org is the official website of the movement, providing information and resources on its activities and campaigns. The organization operates in the NGOs and associations sector, focusing on social and political issues. BDS.org was listed as a ransomware victim associated with insomnia |
|||||
| Ransomware | Brooklyn Defender Services id30828 View details | United States | NGOs / Associations | ||
|
Brooklyn Defender Services is a public defense office providing free, client-centered representation and advocacy in and out of court, protecting people from loss of freedom, family separation, and serious legal harm by unjust, racist systems. |
|||||
| Ransomware | ************* id30024 View details | United States | — | ||
|
www.********.com is a US-based organization operating in the technology sector, providing various services to its customers. The company is headquartered in the United States and offers a range of products and solutions. www.********.com was listed as a ransomware victim associated with insomnia |
|||||
| Ransomware | ************* id30024 View details | United States | — | ||
|
Law firm provide legal services to individuals, businesses, and organizations. Their attorneys handle advice, court representation, contracts, and dispute resolution across areas like corporate, family, real estate, and estate law. |
|||||
| Ransomware | The Vant Group id29815 View details | United States | Finance / Legal / Insurance | ||
|
The Vant Group, founded in 1999, is an M&A advisory firm serving businesses up to $250M in revenue. It provides valuations, sell/buy-side advisory, and employee/partner buyouts, leveraging experienced professionals. Clients are mainly entrepreneurs and owners. |
|||||
| Ransomware | Mid-Cumberland Human Resource Agency id29715 View details | United States | NGOs / Associations | ||
|
MCHRA is a nonprofit promoting self-sufficiency via Meals-on-Wheels, public transit, in-home services, and community corrections. It serves adults needing care, transit users, and long-term care residents, emphasizing inclusivity and translation services. |
|||||
| Ransomware | Nephrology Associates id28498 View details | United States | IT | ||
|
Nephrology Associates, PA is a leading central Arkansas nephrology practice with seven highly trained physicians across seven locations. They provide compassionate kidney care, accept all insurances, and aim to create a welcoming environment for patients. |
|||||
| Ransomware | METO Systems id28648 View details | United States | Manufacturing / Engineering | ||
|
METO Systems designs and manufactures stainless-steel industrial material‑handling equipment for regulated industries. Products include lifts, blenders, transporters, and docking systems, they offer installation, training, customization, and support. |
|||||
| Ransomware | United Medical Doctors id28043 View details | United States | Healthcare / Pharma | ||
|
United Medical Doctors (UMD) is an independent multi‑specialty medical‑surgical group with 70+ Southern California locations and 40+ specialties. They focus on high‑quality, compassionate care, patient satisfaction, process improvement, outpatient surgery, clinical research. |
|||||
| Ransomware | Noble Inc. id27951 View details | United States | Energy | ||
|
Noble Casing, Inc., founded in 2009, provides casing running and conductor drilling services in the Rocky Mountain region, emphasizing safety, training and equipment upkeep. Subsidiaries Noble Drilling and Noble Trucking support production and rig moves. |
|||||
| Ransomware | *****d **d**** ****o** id27838 View details | United States | Other | ||
|
Functions as a comprehensive healthcare ecosystem—combining clinical care, surgical services, research innovation, and workforce development—all under one organization dedicated to improving community health in California |
|||||
| Ransomware | Atlas Ocean Voyages id27535 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Atlas Ocean Voyages offers year-round all-inclusive expedition cruises for under 200 guests, led by expert guides and caring crew. Luxurious yachts sail pole‑to‑pole to pristine, hard‑to‑reach destinations for nature, culture, and culinary exploration. |
|||||
| Ransomware | Valley Family Health Care id27422 View details | United States | Healthcare / Pharma | ||
|
Valley Family Health Care is a Community Health Center offering medical, dental, behavioral health, and nutrition services. With 12 locations (including a mobile unit), they accept major insurances and provide income-based sliding fees to ensure accessible care. |
|||||
| Ransomware | **l** ****** ****** C*** id27382 View details | United States | Healthcare / Pharma | ||
|
A multi-service, accessible community health network designed to provide inclusive, affordable care to all. |
|||||
| Ransomware | Belmont Plastic Surgery id27021 View details | United States | Healthcare / Pharma | ||
|
Belmont Plastic Surgery, led by award-winning surgeon Dr. Jules Feledy, offers comprehensive cosmetic and reconstructive procedures. The practice specializes in breast augmentation, body contouring, and facial rejuvenation, delivering natural-looking. |
|||||
| Ransomware | Ripple Neuro id26884 View details | United States | Telecommunications | ||
|
Ripple Neuro builds neuroscience research tools and medical devices for electrophysiology, offering portable wireless processors, implantable tech, and accessories for various models. They serve researchers in BCI, closed-loop stimulation, and wireless signal acquisition. |
|||||
| Ransomware | Thrash Commercial Contractors id26866 View details | United States | Construction / Real Estate | ||
|
Thrash is a Southeast commercial builder offering general contracting, construction management, preconstruction, and design-build. Known for detailed execution, clear communication, and strong client relationships across institutions and states. |
|||||
| Ransomware | Zaner Group id26851 View details | United States | Communication / Marketing | ||
|
Zaner, a family-owned brokerage since 1980, provides global commodities risk-management, advisory, research, and trading tech. Serving futures, metals, currencies, energies and agriculture, they offer hedging, precious metals solutions, competitive pricing. |
|||||
| Ransomware | AdMark Asia Group id26644 View details | United States | Retail / E-commerce | ||
|
AdMark Home is a leading Asia-wide executive search firm (offices in Hong Kong, Shanghai, Tokyo) specializing in consumer, communication and retail sectors. With 7,000+ placements, they emphasize deep client insight, diligent screening, and long-term partnerships. |
|||||
| Ransomware | Application Solution Providers id26643 View details | United States | Communication / Marketing | ||
|
Application Solution Providers, Inc. delivers cloud-based DaaS and software, plus consulting, development, marketing, support, and training—enabling flexible, remote operations with tailored, customer-focused solutions to boost efficiency. |
|||||
| Ransomware | Copier Careers id26503 View details | United States | Communication / Marketing | ||
|
Copier Careers is a recruiting firm connecting Copier Channel employers with skilled professionals. It focuses on strategic placements—Sales Reps, Managers, and other office equipment roles—to help businesses grow, and provides job seekers a job board. |
|||||
| Ransomware | The Syverson Group id26502 View details | United States | Healthcare / Pharma | ||
|
TSG is a retained executive search firm specializing in medical device and life sciences recruiting. They deliver rapid, client and candidate-focused talent acquisition—including diagnostics, clinical research and leadership placement. |
|||||
| Ransomware | Aviam Corporate Housing id26434 View details | United States | Construction / Real Estate | ||
|
Aviam is the nation's premier corporate housing provider, offering furnished, fully equipped accommodations with maid service, 24/7 emergency support, and customizable packages for executives, teams, or interns — more comfort and savings than hotels. |
|||||
| Ransomware | Advanced Healthcare Professionals id26356 View details | United States | Healthcare / Pharma | ||
|
Advanced Healthcare Professionals offers compassionate personal care attendants in homes, apartments, and assisted living. With 10+ years serving hundreds of clients, we match qualified caregivers to tailored schedules—24/7, including holidays. |
|||||
| Ransomware | Integrated Fresh Solutions id26355 View details | United States | Services | ||
|
IFS supplies fresh produce, perishable logistics, warehousing, and custom support to foodservice, retail, and wholesale. With subsidiaries Fresh-Link Produce, Kool Logistics, and Synergy Worldwide, IFS streamlines farm-to-table operations. |
|||||
| Ransomware | Gruel Mills Nims Pylman id26354 View details | United States | Communication / Marketing | ||
|
Gruel Mills Nims Pylman PLLC is a Grand Rapids personal injury firm with national reach. With 35 years experience, they represent victims of vehicle-construction accidents, sexual abuse, and medical malpractice, focusing on trust, access, and full compensation. |
|||||
| Ransomware | Carlyle Senior Care of Florence id26353 View details | United States | Healthcare / Pharma | ||
|
CSC, a respected private nursing home, delivers high-quality skilled nursing, memory care, rehabilitation, medication management, assistance with ADLs, nutritious meals, social programs, and end-of-life care in a supportive, community-driven environment. |
|||||
| Ransomware | Internal Medicine of Milford id26352 View details | United States | Healthcare / Pharma | ||
|
Internal Medicine of Milford — a patient-focused practice in Milford, CT offering internal and family medicine: acute care, preventive services, chronic disease management, and in-office testing for individuals and families seeking trusted, high-quality local care. |
|||||
| Ransomware | Rella Associates id26351 View details | United States | Communication / Marketing | ||
|
Rella Associates, P.C. provides legal help in Workers Compensation, Social Security Disability, and NYCERS for job injuries and illnesses. Led by Gerarda Rella and Michael Catallo, the Sleepy Hollow firm delivers personalized, aggressive representation and timely client communication. |
|||||
| Ransomware | Flint Hills Dialysis id26350 View details | United States | Healthcare / Pharma | ||
|
Flint Hills Dialysis focuses on dialysis and chronic kidney disease management, creating personalized treatment plans to improve patients' lives. With clinics in Manhattan and Marysville, Kansas, their team emphasizes patient education and compassionate care. |
|||||
| Ransomware | Southern Illinois Dermatology id26349 View details | United States | Communication / Marketing | ||
|
Southern Illinois Dermatology, founded in 1996 by Board-Certified Dr. Ted G. Van Acker, has grown from one office to 15 locations. We offer general, surgical, cosmetic dermatology and advanced laser treatments with attentive, professional care. |
|||||
| Ransomware | Parts Life, Inc id26348 View details | United States | Manufacturing / Engineering | ||
|
Parts Life, Inc., is an certified supplier of engineering, manufacturing, and alternate-source DMSMS solutions for military systems. Our reverse engineering and R.O.P.E. services produce source-approved manufacturable data; prototypes tested for form, fit, function. |
|||||
| Ransomware | DeVal LCS id26347 View details | United States | Communication / Marketing | ||
|
DeVal LCS is a U.S. mechanical and electro-mechanical manufacturer specializing in armament and ground‑support equipment for the DoD. An AS9100D-certified business, DeVal provides build-to-print turnkey manufacturing, precision machining, and assembly. |
|||||
| Ransomware | SchureMed id26346 View details | United States | Communication / Marketing | ||
|
SchureMed makes surgical patient-positioning equipment that improves safety, comfort, and outcomes. Their range covers orthopedic, laparoscopic, and custom OR solutions, backed by in-house R&D, manufacturing, competitive pricing, and tailored customer service. |
|||||
| Ransomware | Optimum Health Institute id26345 View details | United States | Healthcare / Pharma | ||
|
Optimum Health Institute (OHI) runs faith-based, holistic 3-week wellness retreats in San Diego and Austin. Combining classes, activities, and nutrient-rich meals, OHI supports body, mind, and spirit for stress reduction, fitness, and spiritual growth. |
|||||
| Ransomware | Anatomic Clinical Laboratory Associates id26344 View details | United States | Healthcare / Pharma | ||
|
Nashville-based physician-owned pathology group serving Middle Tennessee with high-quality diagnostics care with timely reporting and accessibility for clinicians, subspecialty expertise, timely reports, and community care for uninsured patients |
|||||
| Ransomware | Dunn and Dunn id26343 View details | United States | Communication / Marketing | ||
|
Dunn and Dunn is a Boston - based law firm established in 1928. They specialize in providing legal counsel and representation to healthcare professionals. Core practice areas include: Medical malpractice defense, Long-term care defense, General liability defense |
|||||
| Ransomware | Tri-Cities Gastroenterology id26342 View details | United States | Energy | ||
|
Tri-Cities Gastroenterology provides comprehensive digestive care focused on whole-person wellness, using human and technological resources to ensure patient comfort and timely, reliable information and reports for referring physicians. |
|||||
| Ransomware | Enviro-Hub Holdings id26341 View details | Singapore | Healthcare / Pharma | ||
|
Enviro-Hub restores the environment using innovative technologies. It trades, recycles and refines e-waste and metals, supplies healthcare products, and manages property investments. The firm serves clients needing sustainable waste management and healthcare solutions. |
|||||
| Ransomware | Chiarottino id26340 View details | Brazil | Finance / Legal / Insurance | ||
|
Chiarottino and Nicoletti Advogados is full-service law firm in corporate law, offering tailored legal services across environment, arbitration, finance, compliance, litigation, contracts, digital, family, real estate, capital markets, IP, labor, tax, wealth. |
|||||