Ransomware Group intelligence
Section9
ActiveTrack Section9 with 36 published victims and 1 known leak locations in a single intelligence view.
Overview
Section9 is tracked by Breach House as a ransomware group with 36 published victims.
Brazil is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Unknown | v76bdil3v7hczufr7kwk75eq6oks27d3qwj6v5ajj6v6rubbvwhcq2qd.onion |
Top Activity Sectors
No sector intelligence available.
Ransom Notes (0)
▼No ransom notes available for this group.
Tools Used
▼No tools used available.
YARA Rules (0)
▼No YARA rules available.
Indicators of Compromise (0)
▼No IoCs available for this group.
Negotiation Chats (0)
▼No negotiation chats available.
Research Sources
No external research sources linked yet.
Victims (36)
Search, filter and paginate the victim timeline for Section9. Showing 1–36 of 36.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | *****.com.pt id30900 View details | Portugal | Other | ||
|
*****.com.pt is a company based in Portugal, operating in the Other sector. The company likely provides specialized services or products, given its sector classification. *****.com.pt was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | *****.com.pt id30900 View details | Portugal | Other | ||
|
UNIVERSITY |
|||||
| Ransomware | ********.com.uy id30901 View details | Uruguay | Other | ||
|
********.com.uy is an entity based in Uruguay, operating in the other sector. The entity is likely to provide various offerings to its customers, given its location and sector. ********.com.uy was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ********.com.uy id30901 View details | Uruguay | Other | ||
|
FOOD & SERVICES |
|||||
| Ransomware | ****.fr id30902 View details | France | Other | ||
|
****.fr is a French organization operating in the other sector, providing various offerings to its clients in France. The entity is part of a diverse range of businesses in the country, contributing to the local economy. ****.fr was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ****.fr id30902 View details | France | Other | ||
|
RETAIL |
|||||
| Ransomware | ********.com id30903 View details | United States | — | ||
|
********.com is a US-based entity operating in its respective sector, providing various offerings to its customers. The company is located in the United States and caters to a specific industry. ********.com was listed as a ransomware victim associated with Section9 |
|||||
| Ransomware | ********.com id30903 View details | United States | — | ||
|
NEWS |
|||||
| Ransomware | ******.com.se id30904 View details | Sweden | Other | ||
|
******.com.se is a company based in Sweden, operating in the Other sector. The company provides various offerings to its customers, although specific details about its services are not publicly available. ******.com.se was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ******.com.se id30904 View details | Sweden | Other | ||
|
HEALTHCARE |
|||||
| Ransomware | ******.com id30905 View details | United States | Other | ||
|
******.com is a company based in the US, operating in the other sector. The company provides various offerings to its customers. ******.com was listed as a ransomware victim associated with Section9 |
|||||
| Ransomware | ******.com id30905 View details | United States | Other | ||
|
CYBERSECURITY |
|||||
| Ransomware | ****.com.mc id30906 View details | Monaco | Other | ||
|
****.com.mc is a company based in Monaco, operating in the other sector. The company is located in the country with the country code MC. ****.com.mc was listed as a ransomware victim associated with Section9 |
|||||
| Ransomware | ****.com.mc id30906 View details | Monaco | Other | ||
|
TRAVEL & TOURISM |
|||||
| Ransomware | *****.ind.br id30907 View details | Brazil | Other | ||
|
*****.ind.br is an industrial organization based in Brazil, operating in the other sector. The entity likely provides various industrial services or products, given its domain name and location. *****.ind.br was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | *****.ind.br id30907 View details | Brazil | Other | ||
|
AGRICULTURE |
|||||
| Ransomware | ********** id30908 View details | Other | |||
|
The company operates in the other sector, providing various offerings. It is located in an unspecified area and serves a particular market. The company was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ********** id30908 View details | Other | |||
|
CYBERSECURITY |
|||||
| Ransomware | *****.com.br id30909 View details | Brazil | Other | ||
|
*****.com.br is a Brazilian entity operating in the Other sector. The company is based in Brazil and provides various offerings. *****.com.br was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | *****.com.br id30909 View details | Brazil | Other | ||
|
FINTECH |
|||||
| Ransomware | ****.com.br id30910 View details | Brazil | Other | ||
|
****.com.br is a Brazilian entity operating in the Other sector, providing unspecified services in Brazil. The company's presence is primarily in the Brazilian market, catering to local needs. ****.com.br was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ****.com.br id30910 View details | Brazil | Other | ||
|
TELECOM |
|||||
| Ransomware | ****.com id30911 View details | Belgium | Other | ||
|
****.com is a company based in Belgium, operating in the Other sector. The company likely provides specialized services or products, given its sector classification. ****.com was listed as a ransomware victim associated with Section9 |
|||||
| Ransomware | ****.com id30911 View details | Belgium | Other | ||
|
INDUSTRY |
|||||
| Ransomware | *******.com id30912 View details | United States | Other | ||
|
*******.com is a US-based entity operating in the other sector, providing various offerings to its customers. The company is located in the United States and serves its clients with a range of services. *******.com was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | *******.com id30912 View details | United States | Other | ||
|
ECOMMERCE |
|||||
| Ransomware | ********.com.jp id30913 View details | Japan | Other | ||
|
********.com.jp is a Japanese entity operating in the other sector, providing various offerings to its customers in Japan. The entity is part of the diverse Japanese industry, with its base of operations in Japan. ********.com.jp was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ********.com.jp id30913 View details | Japan | Other | ||
|
SOFTWARE |
|||||
| Ransomware | *****.com.cn id30914 View details | China | Other | ||
|
*****.com.cn is a Chinese entity operating in the other sector, providing various offerings to its customers in China. The company is based in China and serves the local market. *****.com.cn was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | *****.com.cn id30914 View details | China | Other | ||
|
FINANCE |
|||||
| Ransomware | ******.net.br id30915 View details | Brazil | Other | ||
|
******.net.br is a Brazilian entity operating in the Other sector. The entity is based in Brazil and likely provides services to a local or regional client base. ******.net.br was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ******.net.br id30915 View details | Brazil | Other | ||
|
TAX |
|||||
| Ransomware | ******.com.br id30916 View details | Brazil | Other | ||
|
******.com.br is a Brazilian entity operating in the other sector, providing various offerings to its customers in Brazil. The company is part of a diverse range of businesses in the country. ******.com.br was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ******.com.br id30916 View details | Brazil | Other | ||
|
MEDIA |
|||||
| Ransomware | ********.com.br id30917 View details | Brazil | — | ||
|
********.com.br is a Brazilian entity operating in its respective sector, providing various offerings to its customers in Brazil. The company is located in Brazil and serves the local market with its services. ********.com.br was listed as a ransomware victim associated with Section9. |
|||||
| Ransomware | ********.com.br id30917 View details | Brazil | — | ||
|
MINING |
|||||