Ransomware Group intelligence
Madliberator
InactiveTrack Madliberator with 16 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Madliberator is tracked by Breach House as a ransomware group with 16 published victims.
Spain is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
16
- Leaked 0 0.0%
- Pending 16 100.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 22m ago | k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion |
Top Activity Sectors (9)
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue Madliberator, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: madliberator executes malicious payloads using PowerShell cmdlets to stage ransomware binaries and evade detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: madliberator modifies Windows Registry Run keys to ensure ransomware execution upon system reboot.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: madliberator disables antivirus tools by terminating security processes and modifying Windows Defender settings.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: madliberator deletes Volume Shadow Copies and backup directories via vssadmin commands to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: madliberator scans network shares using Windows Explorer APIs to identify victim file directories for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: madliberator moves laterally across SMB shares to encrypt additional systems within the victim network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: madliberator exfiltrates victim data using encrypted channels before deploying ransomware to enable double extortion.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: madliberator encrypts victim files using AES-256 encryption applied to user directories and critical system paths.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: madliberator calls system shutdown scripts to disrupt recovery processes and maximize operational impact.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (16)
Search, filter and paginate the victim timeline for Madliberator. Showing 1–16 of 16.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | marthamedeiros.com.br id14549 View details | Brazil | Communication / Marketing | pending | ||
|
Martha Medeiros e uma estilista apaixonada que transformou a renda feita a mao em sua assinatura distintiva na alta costura. Nascida em Alagoas na decada de 1960, desde jovem foi inspirada pela avo a observar a natureza ao redor, uma fonte inesgotavel de cores e formas que viriam a moldar seu olhar para a moda. Enquanto aprendia a costurar para suas bonecas, absorvia licoes preciosas sobre estetica e criatividade. |
||||||
| Ransomware | ctelift.com id14199 View details | Italy | Communication / Marketing | pending | ||
|
Since 1981 CTE has been creating solutions to make working at height easier and safer. This is our promise. A company with an Italian heart and history behind it along with an international vocation. We continue to put our customers at the center of our projects and services. We listen to the needs of each of our clients. Companies from all over Italy, Europe and North America rely on CTE having found a partner who can meet their expectations. |
||||||
| Ransomware | ych.com id14165 View details | United States | Services | pending | ||
|
Founded in 1955 by the late Mr Yap Chwee Hock, YCH began as a modest passenger transportation company. However, in the 1970s, the family business lost its main contract. With the need to diversify the business, Mr Yap Chwee Hock roped in his eldest son, |
||||||
| Ransomware | awsag.com id13878 View details | Germany | Communication / Marketing | pending | ||
|
We have more than 20 years of experience in consulting and engineering and focus on the highest standards of safety, reliability and performance. At AWS, authenticity, honesty and transparency are the focus of our work and we strive to deliver excellent products to our customers. We support our customers every step of the way and continuously work to expand our expertise and knowledge to provide the best solution for our customers. |
||||||
| Ransomware | suandco.com id13722 View details | Korea, Republic of | Communication / Marketing | pending | ||
|
Suandco tiene su origen en el despacho fundado en 1951 por Don Francisco Suarez Sotillo, abogado e Inspector de Hacienda. Uno de los primeros despachos de Madrid especializados en Derecho Tributario. Llevamos tres generaciones asesorando familias y empresas que han depositado su confianza en nosotros. Por que? Porque aquilas personas nos importan y son el centro de nuestra profesion. |
||||||
| Ransomware | msprocuradores.es id13715 View details | Spain | Communication / Marketing | pending | ||
|
Segura Procuradores SLP es una sociedad profesional, dedicada al ejercicio de la procura a nivel nacional, con despachos abiertos en Barcelona, Madrid. Su sede central, en Barcelona, está ubicada en el enclave judicial construido al efecto, lo cual nos permite ofrecer una rápida respuesta a nuestros clientes y abogados, hasta el último minuto de cierre de los juzgados.Cuenta entre sus clientes con importantes Bancos, Establecimientos Financieros de Crédito, Organismos Públicos y empresas .... |
||||||
| Ransomware | coinbv.nl id13659 View details | Netherlands | IT | pending | ||
|
COIN is your hands-on partner for IT Continuity, Disaster & Workplace Recovery, and Cyber Security. The fast increase of, for instance, the volume of cyber / ransomware incidents, power cuts and other disasters, is forcing organisations to closely examine their critical digital company processes, secure their data and ensure the continuous availability of quantitative and qualitative human resources, preferably redundant.Services:Cyber response, SOC and SIEM As A Service, Data protection and data management |
||||||
| Ransomware | orbinox.com id13537 View details | Manufacturing / Engineering | pending | |||
|
ORBINOX was founded in Tolosa in 1964, manufacturing industrial valves to fulfil the increasing demand of the local paper industry. ORBINOX is the leading European knife gate valve manufacturer. Our continued market leadership is the result of staying true to our Mission, Vision and Values. We offer a wide range of valves, penstocks/sluice gates and dampers which cover a variety of applications. We have a highly qualified and experienced team providing the best solutions to suit the needs of our customers. |
||||||
| Ransomware | ORBINOX id13508 View details | Spain | Manufacturing / Engineering | pending | ||
|
ORBINOX was founded in Tolosa in 1964, manufacturing industrial valves to fulfil the increasing demand of the local paper industry. ORBINOX is the leading European knife gate valve manufacturer. Our continued market leadership is the result of staying true to our Mission, Vision and Values. We offer a wide range of valves, penstocks/sluice gates and dampers which cover a variety of applications. We have a highly qualified and experienced team providing the best solutions to suit the needs of our customers. |
||||||
| Ransomware | vrd.be id13507 View details | Belgium | Transportation / Travel / Logistics | pending | ||
|
VRD is een modern transportbedrijf waarbij kwaliteit, flexibiliteit en klantgerichtheid voorop staan. Wij staan in voor het vervoer van containers en trailers, zowel nationaal als internationaal en zorgen voor een aanpak op maat voor iedere klant. Uw goederen veilig, op het juiste moment, op de juiste plaats en tegen een correcte prijs afleveren is waar we bij VRD voor bekend staan. |
||||||
| Ransomware | VITALDENT id13402 View details | Spain | Healthcare / Pharma | pending | ||
|
Vitaldent is a dental company founded in 1989. Today, it has more than 400 clinics in Spain , has treated more than 8 million patients and has a large team of 3,500 professionals and 2,000 collaborating dentists. Its turnover is around 300 million euros. Advent International one of the most relevant and experienced private equity firms in the world, is the majority shareholder of Vitaldent... |
||||||
| Ransomware | BENICULTURALI.IT id13401 View details | Italy | Other | pending | ||
|
Il Ministero per i Beni Culturali e Ambientali fu istituito da Giovanni Spadolini, (con decreto-legge 14 dicembre 1974, n. 657 [ atto originario | atto originario con aggiornamenti], convertito nella legge 29 gennaio 1975, n. 5 [atto originario | atto originario con aggiornamenti]- G.U. 14 febbraio 1975, n. 43), con il compito di affidare unitariamente alla specifica competenza di un Ministero appositamente costituito la gestione del patrimonio culturale e dell'ambiente al fine di assicurare l'organica tutela... |
||||||
| Ransomware | MONTERO & SEGURA id13400 View details | Spain | Communication / Marketing | pending | ||
|
Segura Procuradores SLP es una sociedad profesional, dedicada al ejercicio de la procura a nivel nacional, con despachos abiertos en Barcelona, Madrid. Su sede central, en Barcelona, está ubicada en el enclave judicial construido al efecto, lo cual nos permite ofrecer una rápida respuesta a nuestros clientes y abogados, hasta el último minuto de cierre de los juzgados.Cuenta entre sus clientes con importantes Bancos, Establecimientos Financieros de Crédito, Organismos Públicos y empresas .... |
||||||
| Ransomware | crosswear.co.uk id13399 View details | United Kingdom | Services | pending | ||
|
Crosswear has been trading since 1972 and business has evolved to become very much focused on wholesale distribution to the partyware and greeting card trades. |
||||||
| Ransomware | sacities.net id13398 View details | South Africa | Public Sector | pending | ||
|
Our vision and mission is crucial to the work we do. Integral to the South African Cities Network is the promotion of good governance and management of South African cities.We analyse strategic challenges facing South African cities, particularly in the context of global economic integration and national development; collect, collate, analyse, disseminate and apply the experience of large city government in a South African context; and promote a shared-learning partnership between different spheres of government to... |
||||||
| Ransomware | zb.co.zw id13397 View details | Zimbabwe | Finance / Legal / Insurance | pending | ||
|
In 1972, the company changed its name from The Netherlands Bank of Rhodesia Limited to Rhodesia Banking Corporation Limited and then to Rhobank in 1979. It changed its name once again in 1981 to Zimbabwe Banking Corporation after the Government purchased the majority shareholding. ZB Financial Holdings is one of the most diversified financial services counter on the Zimbabwe Stock Exchange. |
||||||