Ransomware Group intelligence

Raworld

Inactive

Track Raworld with 127 published victims and 2 known leak locations in a single intelligence view.

Victims 127 Known published victims in this dataset

First discovered 2023-05-06 Earliest victim discovery date

Last discovered 2024-12-28 Latest victim discovery date

Inactive since 567 days Days since the latest known victim

Top country United States 18 victims

Known locations 2 Leak or negotiation infrastructure tracked

Raworld is tracked by Breach House as a ransomware group with 127 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 1	Onion service	Unknown	`raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion`
Leak location 2	Onion service	Unknown	`pa32ymaeu62yo5th5mraikgw5fcvznnsiiwti42carjliarodltmqcqd.onion`

No sector intelligence available.

Ransom Notes (0)

▼

No ransom notes available for this group.

Tools Used

▼

No tools used available.

YARA Rules (0)

▼

No YARA rules available.

Indicators of Compromise (0)

▼

No IoCs available for this group.

Negotiation Chats (0)

▼

No negotiation chats available.

No external research sources linked yet.

Victims (127)

Search, filter and paginate the victim timeline for Raworld. Showing 1–100 of 127.

Type	Target	Discovered	Country	Business Category
Ransomware	Watertown Public Schools id16422 View details	2024-12-28	United States	Education
[AI generated] Watertown Public Schools is a school district located in Watertown, Massachusetts. It serves a diverse community, offering education from pre-kindergarten through 12th grade. The district is committed to fostering an inclusive environment and emphasizes academic excellence, critical thinking, and social-emotional development. Schools include elementary, middle, and high schools, focusing on preparing students for future success. ID 16422
Ransomware	STEG Stadtentwicklung id16421 View details	2024-12-28	Germany	Communication / Marketing
[AI generated] STEG Stadtentwicklung is a company focused on urban development and planning. It specializes in revitalizing urban areas, creating sustainable urban environments, and promoting community involvement in development projects. The company collaborates with municipalities, private investors, and stakeholders to design and implement projects that enhance urban life, ensuring economic, social, and environmental sustainability. ID 16421
Ransomware	Ire-Omba SpA id16420 View details	2024-12-28	Italy	Communication / Marketing
[AI generated] Ire-Omba SpA is an Italian company specializing in the production and export of wooden products, particularly timber and finished wood components. With a focus on sustainability and quality, they source wood responsibly and serve various industries, including construction and furniture. The company is known for its expertise in processing and treating wood to meet diverse client specifications. ID 16420
Ransomware	Grup id16276 View details	2024-12-22		Other
No additional victim description available. ID 16276
Ransomware	Deep id16275 View details	2024-12-22		Other
No additional victim description available. ID 16275
Ransomware	Riuk id16274 View details	2024-12-22		Other
No additional victim description available. ID 16274
Ransomware	NEIT id16273 View details	2024-12-22		Other
No additional victim description available. ID 16273
Ransomware	Wals id16272 View details	2024-12-22		Other
No additional victim description available. ID 16272
Ransomware	STng id16271 View details	2024-12-22		Other
No additional victim description available. ID 16271
Ransomware	Compass Communications id15994 View details	2024-12-11	New Zealand	Communication / Marketing
[AI generated] Compass Communications is a telecommunications company based in New Zealand. It offers a range of services, including broadband internet, mobile phone plans, and home phone services. Known for competitive pricing and customer-focused service, Compass Communications caters to both residential and business customers, aiming to provide reliable connectivity solutions across the country. ID 15994
Ransomware	NTrust id15862 View details	2024-12-04	United States	Services
[AI generated] NTrust is a global real estate and facilities management services company that specializes in lease administration, lease accounting, and technology solutions. They offer services such as transaction management, data abstraction, and portfolio management. NTrust leverages advanced software and analytics to optimize real estate operations, helping clients streamline processes and improve decision-making. ID 15862
Ransomware	Cons id15861 View details	2024-12-04		Other
No additional victim description available. ID 15861
Ransomware	NTst id15791 View details	2024-12-02		Other
No additional victim description available. ID 15791
Ransomware	Contrack Facilities Management id15694 View details	2024-11-27	United Arab Emirates	Services
[AI generated] Contrack Facilities Management is a company specializing in comprehensive facilities management services. They provide solutions for property maintenance, operations, and support services. Their offerings often include building maintenance, cleaning, security, and energy management, tailored to enhance the efficiency and sustainability of client properties. They cater to various sectors, ensuring optimal facility performance. ID 15694
Ransomware	Ventana Micro Systems id15693 View details	2024-11-27	United States	IT
[AI generated] Ventana Micro Systems is a technology company specializing in the development of high-performance RISC-V processors. The company focuses on delivering scalable and efficient computing solutions for data centers and edge computing applications. By leveraging the open RISC-V architecture, Ventana aims to provide innovative, customizable processors that balance performance, power efficiency, and flexibility. ID 15693
Ransomware	Lung id15692 View details	2024-11-27		Other
No additional victim description available. ID 15692
Ransomware	Meor id15691 View details	2024-11-27		Other
No additional victim description available. ID 15691
Ransomware	Cont id15607 View details	2024-11-25		Other
No additional victim description available. ID 15607
Ransomware	Gulf Energy Maritime id15586 View details	2024-11-23	United Arab Emirates	Energy
[AI generated] Gulf Energy Maritime is a prominent maritime shipping company based in the United Arab Emirates. It specializes in the transportation of crude oil, petroleum products, and chemicals. The company operates a modern fleet of tankers, ensuring safe and efficient delivery while adhering to high environmental and safety standards. It plays a critical role in the global energy supply chain. ID 15586
Ransomware	Geog id15376 View details	2024-11-17		Other
No additional victim description available. ID 15376
Ransomware	Gume id15375 View details	2024-11-17		Other
No additional victim description available. ID 15375
Ransomware	Orange County Pathology Medical Group id15272 View details	2024-11-12	United States	Healthcare / Pharma
[AI generated] Orange County Pathology Medical Group is a healthcare organization specializing in pathology services. Located in Orange County, California, the group provides diagnostic services and laboratory testing to support patient care. Their team of skilled pathologists works closely with healthcare providers to deliver accurate and timely results, contributing to effective patient diagnosis and treatment. ID 15272
Ransomware	SK Gas id15271 View details	2024-11-12	Korea, Republic of	Energy
[AI generated] SK Gas is a South Korean company primarily involved in the liquefied petroleum gas (LPG) industry. It is a subsidiary of the SK Group, one of South Korea's largest conglomerates. SK Gas operates in the import, storage, and distribution of LPG, serving both domestic and international markets. The company also engages in energy-related services and infrastructure development, focusing on sustainable and innovative energy solutions. ID 15271
Ransomware	BULLONERIE GALVIT id15077 View details	2024-10-31	Italy	Manufacturing / Engineering
[IA generated] BULLONERIE GALVIT is a company specializing in the production and distribution of fasteners and metal components. Known for its high-quality standards, the company offers a wide range of products including bolts, nuts, and screws, catering to various industries such as construction and manufacturing. Their focus on innovation and customer service has established them as a trusted name in the sector. ID 15077
Ransomware	BUIT id15010 View details	2024-10-27		Other
No additional victim description available. ID 15010
Ransomware	TRGB id14992 View details	2024-10-26		Other
No additional victim description available. ID 14992
Ransomware	Matouk Bassiouny id14979 View details	2024-10-25	Egypt	Finance / Legal / Insurance
Matouk Bassiouny is a prominent law firm based in Cairo, Egypt, known for its expertise in arbitration, corporate law, and dispute resolution. The firm serves a diverse clientele, including multinational corporations and local businesses, offering legal services across various sectors. With a strong regional presence, Matouk Bassiouny is recognized for its skilled legal team and client-focused approach. ID 14979
Ransomware	Digital Engineering id14957 View details	2024-10-24	Germany	IT
Digital Engineering is a company specializing in innovative technology solutions and services. They focus on designing and developing digital systems that enhance business operations. Their offerings include software development, systems integration, and consulting services. With a team of skilled engineers, Digital Engineering aims to drive digital transformation and improve efficiency for their clients. ID 14957
Ransomware	Prince Pipes id14916 View details	2024-10-23	India	Communication / Marketing
Prince Pipes and Fittings Limited is a leading Indian manufacturer of polymer pipes and fittings. Established in 1987, the company specializes in producing high-quality piping solutions for plumbing, irrigation, and sewage needs. With a strong distribution network across India, Prince Pipes offers a wide range of products, including CPVC, UPVC, and PPR pipes, emphasizing innovation and sustainability in its operations. ID 14916
Ransomware	P+B Team Aircargo id14915 View details	2024-10-23	Switzerland	Transportation / Travel / Logistics
P+B Team Aircargo is a logistics company specializing in air freight services. They focus on providing efficient and reliable cargo solutions tailored to client needs. With expertise in handling various types of goods, they ensure timely and secure transportation. Their services often include customs clearance, tracking, and end-to-end logistics management, aiming to optimize the supply chain for businesses. ID 14915
Ransomware	Pres id14850 View details	2024-10-20		Communication / Marketing
No additional victim description available. ID 14850
Ransomware	Ding id14849** View details	2024-10-20		Other
No additional victim description available. ID 14849
Ransomware	PBce id14848** View details	2024-10-20		Other
No additional victim description available. ID 14848
Ransomware	Many id13686 View details	2024-08-04		Other
No additional victim description available. ID 13686
Ransomware	Ascent Group id13591 View details	2024-07-28	United States	Services
No additional victim description available. ID 13591
Ransomware	Kusum Group of Companies id13518 View details	2024-07-24	India	Healthcare / Pharma
No additional victim description available. ID 13518
Ransomware	TheLutheranFoundation id13517 View details	2024-07-24	United States	NGOs / Associations
No additional victim description available. ID 13517
Ransomware	Melchers Singapore id13516 View details	2024-07-24	Singapore	Other
No additional victim description available. ID 13516
Ransomware	Asfs id13515 View details	2024-07-24		Other
No additional victim description available. ID 13515
Ransomware	GWF Frankenwein id12247 View details	2024-05-02	Germany	Other
No additional victim description available. ID 12247
Ransomware	Reederei Jüngerhans id12246 View details	2024-05-02	Germany	Other
No additional victim description available. ID 12246
Ransomware	Gren id12245 View details	2024-05-02		Other
No additional victim description available. ID 12245
Ransomware	Meng id12244 View details	2024-05-02		Other
No additional victim description available. ID 12244
Ransomware	Po id12243 View details	2024-05-02		Other
No additional victim description available. ID 12243
Ransomware	Mainwein id12131 View details	2024-04-24	Germany	Other
No additional victim description available. ID 12131
Ransomware	charlesparsons (Attack again) id12084 View details	2024-04-22	United States	Other
No additional victim description available. ID 12084
Ransomware	Main id12083 View details	2024-04-22		Other
No additional victim description available. ID 12083
Ransomware	Laup id12082 View details	2024-04-22		Other
No additional victim description available. ID 12082
Ransomware	UnivationTechnologies id11685 View details	2024-04-16	United States	IT
No additional victim description available. ID 11685
Ransomware	Autoglass id11684 View details	2024-04-16	United Kingdom	Other
No additional victim description available. ID 11684
Ransomware	charlesparsons id11683 View details	2024-04-16	Australia	Other
No additional victim description available. ID 11683
Ransomware	Posa id11682 View details	2024-04-16		Other
No additional victim description available. ID 11682
Ransomware	Gimex id11625 View details	2024-04-12	France	Other
No additional victim description available. ID 11625
Ransomware	Victor Fauconnier id11624 View details	2024-04-12	France	Other
No additional victim description available. ID 11624
Ransomware	Unes id11623 View details	2024-04-12		Other
No additional victim description available. ID 11623
Ransomware	Alch id11622 View details	2024-04-12		Other
No additional victim description available. ID 11622
Ransomware	SebH id11621 View details	2024-04-12		Other
No additional victim description available. ID 11621
Ransomware	Giex id11507 View details	2024-04-03		Other
No additional victim description available. ID 11507
Ransomware	Innomotive Systems Hainichen GmbH id11487 View details	2024-04-03	Germany	Services
No additional victim description available. ID 11487
Ransomware	KICO GROUP id11482 View details	2024-04-02	Germany	Services
No additional victim description available. ID 11482
Ransomware	Sterling Plumbing Inc id11475 View details	2024-04-02	United States	Services
No additional victim description available. ID 11475
Ransomware	C&C Casa e Construção Ltda id11474 View details	2024-04-02	Brazil	Services
No additional victim description available. ID 11474
Ransomware	TUBEX Aluminium Tubes id11473 View details	2024-04-02	Austria	Other
No additional victim description available. ID 11473
Ransomware	SchwarzGrantz id11348 View details	2024-03-23	Germany	Other
No additional victim description available. ID 11348
Ransomware	Title Management Inc id11347 View details	2024-03-23	United States	Services
No additional victim description available. ID 11347
Ransomware	Pascoe International id11346 View details	2024-03-23	United Kingdom	Services
No additional victim description available. ID 11346
Ransomware	Bisco Industries id11324 View details	2024-03-21	United States	Other
biscoind.com is the website for bisco industries, a California-based distributor of electronic components, fasteners, and related assembly hardware. The company is headquartered in Anaheim, California, and serves industries including aerospace, communication, computer, and fabrication. Its website describes online pricing on thousands of parts and same-day shipment, reflecting a broad industrial supply offering. The listing identifies biscoind.com as a ransomware victim associated with raworld. ID 11324
Ransomware	Bluelinea id11323 View details	2024-03-21	France	Other
Bluelinea.com is the website of Bluelinea, a French company based in Versailles that provides health services and teleassistance for elderly and disabled people. Its offerings include connected healthcare, remote assistance, and electronic surveillance systems designed to support safety, autonomy, and caregiving in homes and care facilities. Public company profiles also describe Bluelinea as operating in the healthcare sector with services for seniors and home support in France. In threat-intelligence listings, bluelinea.com was associated with a ransomware victim entry linked to raworld. ID 11323
Ransomware	Deepnoid id11322 View details	2024-03-21	Korea, Republic of	Other
Deepnoid.com is the website of DEEPNOID, a South Korean company founded in 2008 and based in Seoul. It develops artificial intelligence solutions for healthcare, including diagnostic support, medical imaging data management, and AI tools that help automate reading and reporting workflows. The company also presents AI offerings for security, manufacturing, and broader digital transformation use cases. Deepnoid.com was listed as a ransomware victim associated with raworld. ID 11322
Ransomware	Eastern Media International Corporation id11321 View details	2024-03-21	Taiwan, Province of China	Communication / Marketing
Eastern Media International Corporation is a Taiwan-based enterprise headquartered in Taipei and listed on the Taiwan Stock Exchange. Its business spans cargo handling and warehousing, trading, media and audio-visual advertising, retail of pet food and supplies, pet grooming, and leisure and tourism services. Company materials also describe it as part of the Eastern Group, with operations extending into communication technologies and related media activities. In threat-intelligence listings, Eastern Media International Corporation was reported as a ransomware victim associated with raworld. ID 11321
Ransomware	Eyegene id11320 View details	2024-03-21	United States	Other
Eyegene is a biotechnology name associated with gene and cell therapy work, with publicly available company listings describing it as a clinical-stage biotech focused on innovative treatments and prevention. Available profiles place the company in the United States and describe its offerings in research-driven biopharmaceutical development. Separate NIH materials also use the eyeGENE name for a U.S. research network supporting rare inherited eye disease studies, so the name may refer to more than one entity. In this listing, Eyegene was identified as a ransomware victim associated with raworld. ID 11320
Ransomware	Insurance Providers Group id11319 View details	2024-03-21	United States	Finance / Legal / Insurance
Insurance Providers Group is an independent insurance agency based in Champaign, Illinois, serving Central and Southern Illinois since 1996. The agency writes all lines of insurance, including commercial, property, casualty, health, group health, auto, and farm insurance, representing multiple insurance companies to offer diverse products. It provides risk management solutions and group benefits primarily to small to medium-sized businesses in the Finance and Insurance sector. Insurance Providers Group was listed as a ransomware victim associated with the threat actor raworld. ID 11319
Ransomware	Thaire id11318 View details	2024-03-21	Thailand	Other
Thaire, or Thai Reinsurance Public Company Limited, is a Bangkok-based reinsurer in Thailand’s financial services sector. The company provides reinsurance coverage for non-life insurers and focuses on major property and casualty lines. Its business includes property, casualty, engineering, marine, and related risk-transfer services for local and selected foreign clients. The firm operates from Bangkok and serves insurance partners that use reinsurance to diversify risk. It was listed as a ransomware victim associated with raworld. ID 11318
Ransomware	Decimal Point Analytics Pvt id11317 View details	2024-03-21	India	Other
Decimal Point Analytics is an India-based technology and financial research consulting company with a Mumbai headquarters and a U.S. office in New York. Its website describes the firm as delivering AI-driven data analytics, market research, and automation services for smarter decision-making. Company profiles also describe it as a global provider of research and analytics solutions, with offerings spanning data management and predictive insights. In threat-intelligence indexing, decimalpointanalytics.com was listed as a ransomware victim associated with raworld. ID 11317
Ransomware	Wealth Enhancement Group id11316 View details	2024-03-21	United States	Services
WealthEnhancement.com is the website of Wealth Enhancement, a US-based financial services and wealth management firm headquartered in Plymouth, Minnesota, with offices across multiple states. The firm offers advisory services, including investment management, retirement income planning, tax services, estate planning, insurance consultancy, and related client support. Its website and public profiles describe a nationwide, independent advisory practice serving individuals and families through local advisor teams and specialist support. The company was listed as a ransomware victim associated with raworld. ID 11316
Ransomware	Zurvita id11315 View details	2024-03-21	United States	Other
Zurvita.com belongs to Zurvita, a US health and wellness company headquartered in Irving, Texas. The company has sold direct-selling nutritional products, including energy and wellness drinks, protein shakes, cleanses, and related supplements. Public business profiles describe its market as wellness and fitness services, with a focus on consumer health products in the United States and other markets. Zurvita.com was listed as a ransomware victim associated with raworld. ID 11315
Ransomware	Piex Group id11314 View details	2024-03-21	France	Services
Piex Group is a France-based company in Les Ulis, near Paris, with corporate records and company profiles placing it at 3 to 7 Avenue du Cap Horn. Public descriptions identify it as a specialist in exporting healthcare products, including medicines and related health and wellness goods. Its activity is also described in French business records as wholesale trade in health products, including human medicines, medical devices, dietary supplements, and personal care items. In this catalog, Piex Group was listed as a ransomware victim associated with raworld. ID 11314
Ransomware	Yuxin Automobile Co.Ltd id11313 View details	2024-03-21	Singapore	Telecommunications
No additional victim description available. ID 11313
Ransomware	24/7 Express Logistics id11312 View details	2024-03-21	United States	Transportation / Travel / Logistics
No additional victim description available. ID 11312
Ransomware	Aceromex id11311 View details	2024-03-21	Mexico	Other
No additional victim description available. ID 11311
Ransomware	Chung Hwa Chemical Industrial Works id11310 View details	2024-03-21	Taiwan, Province of China	Manufacturing / Engineering
No additional victim description available. ID 11310
Ransomware	SUMMIT VETERINARY PHARMACEUTICALS LIMITED id11309 View details	2024-03-21	United Kingdom	Healthcare / Pharma
No additional victim description available. ID 11309
Ransomware	Informist Media id11308 View details	2024-03-21	India	Communication / Marketing
No additional victim description available. ID 11308
Ransomware	ALAB laboratoria id11307 View details	2024-03-21	Poland	Other
No additional victim description available. ID 11307
Ransomware	Di Martino Group id11306 View details	2024-03-21	Italy	Services
No additional victim description available. ID 11306
Ransomware	Rockford Gastroenterology Associates id11305 View details	2024-03-21	United States	Energy
No additional victim description available. ID 11305
Ransomware	HALLIDAYS GROUP LIMITED id11304 View details	2024-03-21	United Kingdom	Services
No additional victim description available. ID 11304
Ransomware	Die Unfallkasse Thüringen id11303 View details	2024-03-21	Germany	Other
No additional victim description available. ID 11303
Ransomware	Wurzbacher id11302 View details	2024-03-21	Germany	Other
No additional victim description available. ID 11302
Ransomware	Ranzijn id11301 View details	2024-03-21	Netherlands	Other
No additional victim description available. ID 11301
Ransomware	SHORTERM GROUP id11300 View details	2024-03-21	United Kingdom	Services
No additional victim description available. ID 11300
Ransomware	InGmbH id11299 View details	2024-03-21	Germany	Other
No additional victim description available. ID 11299
Ransomware	KIUP id11298 View details	2024-03-21		Other
No additional victim description available. ID 11298
Ransomware	Stnc id11297 View details	2024-03-21		Other
No additional victim description available. ID 11297
Ransomware	Sctz id11296 View details	2024-03-21		Other
No additional victim description available. ID 11296
Ransomware	Di Martino Group id10228 View details	2023-12-20		Services
No additional victim description available. ID 10228
Ransomware	Rockford Gastroenterology Associates id10227 View details	2023-12-20	United States	Energy
No additional victim description available. ID 10227
Ransomware	HALLIDAYS GROUP LIMITED id10226 View details	2023-12-20		Services
No additional victim description available. ID 10226
Ransomware	Die Unfallkasse Thüringen id10225 View details	2023-12-20	Germany	Other
No additional victim description available. ID 10225
Ransomware	NIDEC GPM GmbH id10224 View details	2023-12-20	Germany	Other
No additional victim description available. ID 10224

Raworld

Overview

Top Countries

Known Leak Locations (2)

Top Activity Sectors