Ransomware Group intelligence
L Group
ActiveTrack L Group with 40 published victims and 2 known leak locations in a single intelligence view.
Overview
L Group is tracked by Breach House as a ransomware group with 40 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | 4zrjdyuq4sjogm2epwwoleegquavhwo3o7fakstnlgox6guqt3qpe4qd.onion |
| Leak location 2 | Web location | Unknown | 4zrjdyuq4sjogm2epwwoleegquavhwo3o7fakstnlgox6guqt3qpe4qd.onion/posts |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (40)
Search, filter and paginate the victim timeline for L Group. Showing 1–40 of 40.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | uva.edu.br id31409 View details | Brazil | Education | ||
|
The Universidade Veiga de Almeida, uva.edu.br, is a higher education institution located in Brazil, offering various academic programs. As an educational entity, it plays a significant role in the country's education sector. Uva.edu.br was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | uva.edu.br id31409 View details | Brazil | Education | ||
|
[AI generated] Universidade Veiga de Almeida (UVA) is a private higher education institution based in Rio de Janeiro, Brazil. Founded in 1972, it offers undergraduate and postgraduate courses across various fields including law, health sciences, engineering, and business administration. Operating in the education sector, UVA serves thousands of students through multiple campuses in Rio de Janeiro, providing in-person and distance learning programs. |
|||||
| Ransomware | ausfec1.com.au id31410 View details | Australia | Finance / Legal / Insurance | ||
|
Ausfec1.com.au operates in the finance, legal, and insurance sector in Australia, offering various services to its clients. The company is based in Australia and provides financial and legal solutions. Ausfec1.com.au was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | ausfec1.com.au id31410 View details | Australia | Finance / Legal / Insurance | ||
|
[AI generated] N/A |
|||||
| Ransomware | rosekennedygreenway.org id31411 View details | United States | NGOs / Associations | ||
|
The Rose Kennedy Greenway is a non-profit organization in the United States, dedicated to maintaining and programming a 1.5-mile park in Boston. As a key part of the city's landscape, it offers various events, activities, and green spaces for public enjoyment. The organization operates within the NGOs and associations sector, focusing on community development and environmental conservation. It was listed as a ransomware victim associated with L Group |
|||||
| Ransomware | rosekennedygreenway.org id31411 View details | United States | NGOs / Associations | ||
|
[AI generated] The Rose Kennedy Greenway Conservancy is a nonprofit organization based in Boston, Massachusetts, USA. It manages and maintains the Rose Kennedy Greenway, a series of parks and open spaces built atop the underground Interstate 93 highway in downtown Boston. The conservancy oversees programming, public art installations, gardens, and community events along the corridor, operating within the nonprofit parks and urban green space management sector. |
|||||
| Ransomware | jean-petit.lu id31412 View details | Luxembourg | Retail / E-commerce | ||
|
Jean-petit.lu is a retail and e-commerce company based in Luxembourg, offering various products and services to customers. As an e-commerce platform, it provides online shopping experiences. Jean-petit.lu was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | jean-petit.lu id31412 View details | Luxembourg | Retail / E-commerce | ||
|
[AI generated] N/A |
|||||
| Ransomware | atp.chaco.gob.ar id31413 View details | Argentina | Public Sector | ||
|
atp.chaco.gob.ar is a government website in Argentina, specifically in the Chaco province, providing public services and information to citizens. The website is part of the public sector in Argentina, offering various online services and resources. atp.chaco.gob.ar was listed as a ransomware victim associated with L Group |
|||||
| Ransomware | atp.chaco.gob.ar id31413 View details | Argentina | Public Sector | ||
|
[AI generated] atp.chaco.gob.ar is the official web domain of the Administración Tributaria Provincial (ATP) of Chaco, a government agency located in Chaco Province, Argentina. It operates within the public sector, specifically in tax administration and revenue collection. The agency is responsible for managing provincial taxes, enforcing fiscal regulations, and providing taxpayer services to residents and businesses operating within the Chaco province. |
|||||
| Ransomware | l-a.com.vn id31414 View details | Viet Nam | Other | ||
|
l-a.com.vn is a company based in Vietnam, operating in the other sector. The company provides various offerings to its customers. l-a.com.vn was listed as a ransomware victim associated with L Group |
|||||
| Ransomware | l-a.com.vn id31414 View details | Viet Nam | Other | ||
|
[AI generated] N/A |
|||||
| Ransomware | automobile-mueller.info id31415 View details | Germany | Transportation / Travel / Logistics | ||
|
Automobile-mueller.info is a company operating in the transportation sector in Germany, providing services related to travel and logistics. The entity is involved in activities typical of the transportation industry, such as managing and coordinating the movement of goods and people. It was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | automobile-mueller.info id31415 View details | Germany | Transportation / Travel / Logistics | ||
|
[AI generated] N/A |
|||||
| Ransomware | laticrete.com.cn id31416 View details | China | — | ||
|
Laticrete.com.cn is a website of a company operating in the construction sector, specifically in the field of building materials and construction chemicals, located in China. The company provides a range of products and services to the construction industry. Laticrete.com.cn was listed as a ransomware victim associated with L Group |
|||||
| Ransomware | laticrete.com.cn id31416 View details | China | — | ||
|
[AI generated] LATICRETE China (laticrete.com.cn) is the Chinese subsidiary of LATICRETE International, a global manufacturer of construction materials. Operating in China's building materials industry, the company produces and distributes tile and stone installation systems, waterproofing solutions, flooring underlayments, and surface care products. It serves contractors, architects, and builders across residential and commercial construction sectors throughout mainland China. |
|||||
| Ransomware | mygoalseek.com id31417 View details | United States | IT | ||
|
Mygoalseek.com is a US-based company operating in the IT sector. The company likely provides services related to goal setting and achievement, given its name. Mygoalseek.com was listed as a ransomware victim associated with L Group |
|||||
| Ransomware | mygoalseek.com id31417 View details | United States | IT | ||
|
[AI generated] N/A |
|||||
| Ransomware | psec.com.ar id31418 View details | Argentina | Energy | ||
|
Psec.com.ar is an Argentine company operating in the energy sector, providing various services to its clients. As a key player in the country's energy industry, psec.com.ar is committed to delivering high-quality solutions. Psec.com.ar was listed as a ransomware victim associated with L Group |
|||||
| Ransomware | psec.com.ar id31418 View details | Argentina | Energy | ||
|
[AI generated] N/A |
|||||
| Ransomware | bouygues-es.fr id31419 View details | France | — | ||
|
Bouygues-es.fr is a French entity operating in the construction sector, providing various services in France. The company is part of the Bouygues group, a major player in the construction and civil engineering industry. Bouygues-es.fr was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | bouygues-es.fr id31419 View details | France | — | ||
|
[AI generated] Bouygues Energies & Services (bouygues-es.fr) is a French company operating in the energy and services sector. It is a subsidiary of the Bouygues Group and specializes in electrical engineering, facility management, energy efficiency, smart buildings, and industrial maintenance. The company operates primarily in France and internationally, serving public and private sector clients across infrastructure, construction, and multi-technical services. |
|||||
| Ransomware | ferretornillos.com id31420 View details | Mexico | — | ||
|
Ferretornillos.com is an e-commerce website based in Mexico, offering various products. The company operates in the retail sector, providing online shopping services to its customers. Ferretornillos.com was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | ferretornillos.com id31420 View details | Mexico | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | ratnasagar.com id31421 View details | India | Retail / E-commerce | ||
|
Ratnasagar.com is an e-commerce platform based in India, operating in the retail sector. It offers various products and services to its customers. Ratnasagar.com was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | ratnasagar.com id31421 View details | India | Retail / E-commerce | ||
|
[AI generated] Ratnasagar is an Indian educational publishing company based in India. It specializes in producing academic books, textbooks, and educational materials primarily for school-level students. The company serves the K-12 segment, offering curriculum-aligned content across various subjects. Operating in the education and publishing industry, Ratnasagar is known for distributing its materials through schools and educational institutions across India. |
|||||
| Ransomware | brdigital.net.br id31422 View details | Brazil | IT | ||
|
BRdigital.net.br is a Brazilian company operating in the IT sector, providing various services to its clients. As an IT company, it likely offers a range of technology-related solutions. BRdigital.net.br was listed as a ransomware victim associated with L Group. |
|||||
| Ransomware | brdigital.net.br id31422 View details | Brazil | IT | ||
|
[AI generated] N/A |
|||||
| Ransomware | daycohost.com id31423 View details | United States | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | venezolanadepinturas.com id31424 View details | Venezuela, Bolivarian Republic of | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | nokotapackers.com id31425 View details | United States | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | immobilia.hu id31426 View details | Hungary | — | ||
|
[AI generated] immobilia.hu is a Hungarian real estate platform operating in Hungary. The website serves as an online property marketplace where users can browse, list, and search for residential and commercial real estate, including apartments, houses, and land. It connects buyers, sellers, and renters within the Hungarian property market. The platform targets individuals and agencies looking to conduct real estate transactions across Hungary. |
|||||
| Ransomware | gslusa.com id31427 View details | United States | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | www.racheljulien.com id31428 View details | Canada | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | coastproduce.com id31429 View details | Australia | — | ||
|
[AI generated] Coast Produce Company is a wholesale produce distributor based in the United States, primarily operating in California. The company supplies fresh fruits and vegetables to retailers, restaurants, foodservice operators, and other commercial buyers. It operates within the agricultural distribution and food supply industry, serving clients across the West Coast and broader domestic markets with a focus on quality and reliable cold chain logistics. |
|||||
| Ransomware | zuckers.com id31430 View details | Germany | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | onsite-eng.ca id31431 View details | Canada | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | doclv.com id31432 View details | Latvia | IT | ||
|
[AI generated] N/A |
|||||
| Ransomware | www.upbrand.com id31433 View details | United States | — | ||
|
[AI generated] N/A |
|||||
| Ransomware | cookieskids.com id31434 View details | United States | — | ||
|
[AI generated] Cookies Kids is a retail company based in the United States that specializes in children's clothing, footwear, and accessories. Operating primarily through its website and physical stores in New York, it offers affordable apparel for infants, toddlers, and teens. The company carries a wide range of brands and serves budget-conscious families. It has been a recognized name in children's retail for several decades. |
|||||