Ransomware Group intelligence
J
InactiveTrack J with 41 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
J is tracked by Breach House as a ransomware group with 41 published victims.
United States is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
41
- Leaked 0 0.0%
- Pending 41 100.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 3 | Onion service | Down checked 4h ago | w4d5aqmdxkcsc2xwcz7w7jo6wdmvmakgy3y6mfmdtzmyvxe77cjkfbad.onion |
| Leak location 1 | Onion service | Down checked 4h ago | twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onion |
| Leak location 2 | Onion service | Down checked 4h ago | twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onion |
Top Activity Sectors (11)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue J, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: J executes malicious commands via PowerShell scripts injected into legitimate system processes.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: J establishes persistence by writing malicious entries into Windows Registry Run Keys for automatic startup.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: J disables Windows Defender and security tools by terminating processes and modifying service configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.016 Junk Code Insertion Stealth
What they do: J inserts junk code into binaries to evade static analysis and detection by security tools.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: J deletes Volume Shadow Copies and backup directories via vssadmin and file deletion commands before encryption.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: J performs remote system discovery via Nmap and native API calls to map the internal network topology.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: J scans network shares using SMB tools to identify victim hosts and data repositories for targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: J moves laterally across systems by exploiting SMB/Windows Admin Shares to access additional victims.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: J encrypts victim files using a custom ransomware payload, targeting documents and backups for maximum disruption.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: J calls system recovery inhibition commands to prevent volume recovery attempts after encryption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (41)
Search, filter and paginate the victim timeline for J. Showing 1–41 of 41.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | ikad.com.au - A 5-Month Staycation in the Defense Supply Chain id23754 View details | Australia | Transportation / Travel / Logistics | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ****.com.au id23552 View details | Other | pending | |||
|
No additional victim description available. |
||||||
| Ransomware | Dimensional Control Systems (3dcs.com) id22700 View details | United States | Manufacturing / Engineering | pending | ||
|
[AI generated] Dimensional Control Systems (DCS) is a company specializing in quality management and engineering services. They provide solutions to analyze and predict the impact of variation on product assembly and performance. Their software tools, like the 3DCS variation analyst, assist industries such as automotive, aerospace, medical devices, electronics, to enhance their product quality and manufacturing efficiency. |
||||||
| Ransomware | multi-media systeme AG (mmsag.de) id22686 View details | Germany | Communication / Marketing | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | AZpro Group (azprogroup.com) id22659 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] AZpro Group is a multi-faced company that specializes in graphic design, installation, and printing services. Based in Arizona, the company offers a diverse range of services such as vehicle graphics, custom interior graphics, exterior graphics, retail graphics, and large format printing. With its proven expertise, the company helps businesses enhance brand visibility through high-quality graphic solutions. |
||||||
| Ransomware | Petro-Diamond (petrodiamond.com) - subsidiary of Mitsubishi Corporation id22651 View details | Japan | Energy | pending | ||
|
[AI generated] Petro-Diamond is a commodity trading subsidiary of Mitsubishi Corporation. It's involved in the trade and marketing of petroleum and its derivatives, liquefied petroleum gas (LPG), and carbon-related materials. Also, they handle petrochemicals and participate in energy project developments. |
||||||
| Ransomware | J. E. Stacey & Co. Ltd (jestacey.com) id22647 View details | United Kingdom | Construction / Real Estate | pending | ||
|
[AI generated] J. E. Stacey & Co. Ltd is a UK-based civil engineering firm specializing in the construction industry. Established in 1974, the company provides services such as road works, bridge construction, earthmoving, landfill works, environmental improvements, and more. They have a qualified and experienced workforce known for delivering quality work while maintaining high safety and environmental standards. |
||||||
| Ransomware | raimore.com id22646 View details | Japan | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Virtual Projects (virtualprojects.build) id22645 View details | Denmark | Communication / Marketing | pending | ||
|
[AI generated] Virtual Projects is a construction-focused firm based in Northern California. They are dedicated to providing a comprehensive range of services including preconstruction, project estimating, and construction management. Their cutting-edge technology and experienced personnel allow them to offer virtual design and construction methodologies, assisting clients from concept through to completion. |
||||||
| Ransomware | FAI Aviation Group (fai.ag) - The biggest leak ever id22557 View details | Germany | Transportation / Travel / Logistics | pending | ||
|
[AI generated] FAI Aviation Group is a global aviation service provider based in Germany. The company offers services including aircraft charter, aircraft management, air ambulance services, and special mission services. It owns a fleet of jets and helicopters, making it one of the largest aircraft operators in Europe. The term "The biggest leak ever" does not directly relate to the company's core operations. |
||||||
| Ransomware | southweststone.net id21845 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | a********p.com id21728 View details | Other | pending | |||
|
No additional victim description available. |
||||||
| Ransomware | aym.com.mx id21532 View details | Mexico | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ppmrecruit.com id21531 View details | United Kingdom | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | bridgerecruit.co.uk id21473 View details | United Kingdom | Communication / Marketing | pending | ||
|
[AI generated] "Bridgerecruit.co.uk", also known as Bridge Recruitment, is a UK-based recruitment firm specializing in sectors including IT, Fire & Security, M&E, HVAC, and Facilities Management. The company provides innovative and efficient recruitment solutions, connecting top-notch employers with skilled candidates. They serve both the UK domestic market and international clients, providing a comprehensive range of recruitment services. |
||||||
| Ransomware | restiani.com id21447 View details | Italy | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | gimaex.com id21440 View details | France | Healthcare / Pharma | pending | ||
|
[AI generated] Gimaex is a leading French company specializing in the design and manufacturing of fire and rescue vehicles. With a history spanning over four decades, they are known for innovations and high-quality custom emergency vehicles. They build a range of equipment including fire trucks, firefighting equipment, ambulance vehicles, and special vehicles for civil and military applications. |
||||||
| Ransomware | sou***********.net id21407 View details | Other | pending | |||
|
No additional victim description available. |
||||||
| Ransomware | fecovita.com id20767 View details | Argentina | Communication / Marketing | pending | ||
|
[AI generated] Fecovita is Argentina's largest wine co-operative and exporter, representing over 29 co-operative wineries. Founded in 1991, the company is made up of 5,000 farmers who together own 25% of the vineyards of the province of Mendoza. They produce a wide range of wines, from premium to everyday table wines, which they export to over 20 countries around the world. |
||||||
| Ransomware | rhodar.co.uk id20766 View details | United Kingdom | Services | pending | ||
|
[AI generated] Rhodar is a leading UK company specializing in asbestos removal, demolition and remediation services. It uses cutting-edge technology backed by a highly skilled team to offer bespoke solutions. Their focus is on safeguarding the environment and protecting the health of people, offering services across various sectors including education, retail, health, and commercial buildings. |
||||||
| Ransomware | cisin.com id20754 View details | India | IT | pending | ||
|
[AI generated] Cyber Infrastructure Pvt. Ltd. (CIS), known as cisin.com, is an IT service provider company that develops and delivers customized solutions in software development, mobile app development, AI, and cloud solutions. With the help of its 1000+ experts, CIS offers a unique blend of offshore and onshore client engagement models for startups, SMEs, and large enterprises worldwide. It is headquartered in India with multiple global offices. |
||||||
| Ransomware | powells.biz id20753 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | diffazur.fr id20752 View details | France | Services | pending | ||
|
[AI generated] Diffazur is one of the leading French companies that specializes in designing and building customized, concrete swimming pools. With over 50 years of experience, Diffazur incorporates creativity, quality work, and technical expertise to deliver unique and sustainable pool solutions. They also provide pool maintenance and renovation services. |
||||||
| Ransomware | venezolanadepinturas.com id20388 View details | Venezuela, Bolivarian Republic of | Communication / Marketing | pending | ||
|
[AI generated] Venezolana de Pinturas is a Venezuelan company specializing in the production and commercialization of architectural, industrial, and automotive paint products. Their extensive range includes water and oil-based paints, varnishes, enamels, and other related materials. They focus on innovation and are committed to developing high-quality environmentally friendly products. Venezolana de Pinturas prides itself on its commitment to customer satisfaction and contribution to the national industry. |
||||||
| Ransomware | daycohost.com id20381 View details | Venezuela, Bolivarian Republic of | Services | pending | ||
|
[AI generated] Daycohost is a Latin American company specializing in comprehensive IT services. Headquartered in Caracas, Venezuela, the company offers a wide range of services including cloud storage, colocation, managed hosting, data recovery and cybersecurity solutions. The goal of Daycohost is to support and guide businesses in their digital transformation process. It is an ISO 9001: 2008 certified company known for providing secure and reliable services. |
||||||
| Ransomware | nokotapackers.com id20380 View details | India | Other | pending | ||
|
[AI generated] "N/A" |
||||||
| Ransomware | immobilia.hu id20375 View details | Hungary | Construction / Real Estate | pending | ||
|
[AI generated] Immobilia.hu is a Hungary-based real estate company that specializes in letting, selling, and managing residential and commercial properties. The company offers services that cover all aspects of property transactions such as valuation, marketing, contracting, and legal support. They cater to customers looking for apartments, houses, offices, and commercial spaces in Hungary. Immobilia.hu is recognized for its professional and thorough approach in the real estate industry. |
||||||
| Ransomware | psec.com.ar id19985 View details | Argentina | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | bouygues-es.fr id19984 View details | France | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ferretornillos.com id19983 View details | Spain | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ratnasagar.com id19982 View details | India | Education | pending | ||
|
[AI generated] Ratna Sagar is an educational publishing company based in India with over three decades of experience. They specialize in textbooks for kindergarten to grade 12, with a major focus on English literacy materials. The company's comprehensive resources cover a wide range of subjects and are used in thousands of schools across India. |
||||||
| Ransomware | brdigital.net.br id19981 View details | Brazil | IT | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | uva.edu.br id19695 View details | Brazil | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | ausfec1.com.au id19694 View details | Australia | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | rosekennedygreenway.org id19693 View details | United States | Communication / Marketing | pending | ||
|
[AI generated] The Rose Kennedy Greenway is a contemporary public park in Boston, Massachusetts. Named after Rose Fitzgerald Kennedy, it fuses organic and architectural beauty across several acres of landscaped gardens, promenades, plazas, fountains, art, and specialty areas. It is managed by the non-profit Greenway Conservancy. It is renowned for offering free WiFi, mobile eateries, and community programs all year-round. |
||||||
| Ransomware | jean-petit.lu id19692 View details | Luxembourg | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | atp.chaco.gob.ar id19691 View details | Argentina | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | l-a.com.vn id19690 View details | Viet Nam | Other | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | automobile-mueller.info id19689 View details | Germany | Telecommunications | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | laticrete.com.cn id19688 View details | China | Construction / Real Estate | pending | ||
|
[AI generated] Laticrete is a leading international manufacturer specializing in the construction industry. They offer innovative solutions in tile and stone installation systems, masonry installation and reinforcement, concrete construction chemicals, restoration, and care of tile/stone products. The company's China branch at "laticrete.com.cn" brings these products and services to the Chinese market. |
||||||
| Ransomware | mygoalseek.com id19687 View details | United States | Other | pending | ||
|
[AI generated] N/A |
||||||