Ransomware Group intelligence
Settra
ActiveTrack Settra with 78 published victims and 11 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Settra is tracked by Breach House as a ransomware group with 78 published victims.
United States is currently the most targeted country in this dataset.
11 known leak locations are currently associated with this group.
Leak Status Distribution
78
- Leaked 0 0.0%
- Pending 78 100.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (11)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 6 | Onion service | Up checked 7h ago | settra5ceeidlmbt2d7zupsb3r7djl2azjj4mho5kznmdap6vnoxoxqd.onion |
| Leak location 10 | Onion service | Up checked 7h ago | rz5lecsm2re5ec4im362jnalrypxylxsdobuibuotbovvs4d3ctrcoyd.onion |
| Leak location 8 | Onion service | Up checked 7h ago | hhj2nouojnatg6gvhfgrcqdanoe244gf26pixpnrcoxs7jiqu4atvzyd.onion |
| Leak location 9 | Onion service | Up checked 7h ago | r2vpglmz42fs5762tchek55bg4kdg3c6ozipg7wqs2ghzbhsdtwkzmyd.onion |
| Leak location 1 | Onion service | Up checked 7h ago | settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion |
| Leak location 2 | Web location | Up checked 7h ago | settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onion/leaks |
| Leak location 11 | Onion service | Down checked 7h ago | wqdopgpr7cubbjcf2kiac6ilvamch3renqlzrly2dtwm3uyv2235zryd.onion |
| Leak location 5 | Onion service | Down checked 7h ago | pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onion |
| Leak location 7 | Onion service | Down checked 7h ago | ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onion |
| Leak location 4 | Onion service | Down checked 7h ago | c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onion |
| Leak location 3 | Onion service | Down checked 7h ago | 26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onion |
Top Activity Sectors (14)
- Retail / E-commerce 12
- IT 12
- Manufacturing / Engineering 12
- Finance / Legal / Insurance 7
- Services 5
- Construction / Real Estate 4
- Hospitality / Food & Beverage / Tourism 3
- Healthcare / Pharma 2
- Telecommunications 2
- Transportation / Travel / Logistics 2
- Not identified 2
- Agriculture / Food 2
- Energy 1
- NGOs / Associations 1
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue Settra, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: settra executes malicious payloads through PowerShell scripts to deploy ransomware binaries and evade host-based detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: settra disables security tools by terminating antivirus processes and modifying Windows Defender service configurations on targeted engineering workstations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: settra deletes Volume Shadow Copies and backup directories via vssadmin commands to prevent recovery from manufacturing server snapshots.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1049 System Network Connections Discovery Discovery
What they do: settra discovers system network connections to identify high-value engineering servers and isolate compromised retail environments.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1083 File and Directory Discovery Discovery
What they do: settra uses file and directory discovery via PowerShell to enumerate critical business documents and backups across manufacturing networks.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: settra moves laterally through SMB/Windows Admin Shares using stolen credentials to compromise retail and finance systems across corporate networks.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1560.001 Archive via Utility Collection
What they do: settra archives sensitive operational data using built-in utility commands prior to encryption to maximize financial theft impact.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1486 Data Encrypted for Impact Impact
What they do: settra encrypts victim data using custom symmetric encryption routines targeting engineering CAD files and financial ledgers before demanding ransom.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: settra inhibits system recovery by corrupting Windows restore points and disabling automated backup restoration processes on finance endpoints.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (78)
Search, filter and paginate the victim timeline for Settra. Showing 1–78 of 78.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | dfiretailgroup.com id33336 View details | United States | Retail / E-commerce | pending | ||
|
DFI RETAIL GROUP 27 Years of Email Archives + 397 Illegal Stores + 40,000 Medical Files Over 160 mai... |
||||||
| Ransomware | vestfrostsolutions.com id33119 View details | Norway | IT | pending | ||
|
Vestfrostsolutions.com The company sells reliability and precision — back bar coolers for Red Bull, ... |
||||||
| Ransomware | universalautogroup.com id33063 View details | United States | Retail / E-commerce | pending | ||
|
Universal Auto Group PROLOGUE We obtained thousands of documents belonging to two Washington State c... |
||||||
| Ransomware | namtheun2.com id33064 View details | Lao People's Democratic Republic | — | pending | ||
|
Nam Theun 2: 1.2 TB of Files That Were Never Meant to Leave PROLOGUE VAT declaration №V262120000733,... |
||||||
| Ransomware | lakebeverage.com id33065 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
A Beer Distributor and Its 165 Gigabytes Rochester, New York · WSLR #63124 · September 2026 Prologue... |
||||||
| Ransomware | quantummarketing-group.com id33066 View details | Germany | Services | pending | ||
|
The Cold Call Quantum Technology Marketing Group Limited · Reading, UK Prologue. What's Inside We ha... |
||||||
| Ransomware | moscone.com id33067 View details | United States | Services | pending | ||
|
"We Create Unforgettable Experiences." What ASM Global Hides Backstage at Moscone Center PROLOGUE: O... |
||||||
| Ransomware | gregjoneslaw.com id33068 View details | United States | Finance / Legal / Insurance | pending | ||
|
Documents: Greg Jones & Associates, P.A. PROLOGUE An anonymous $250,000 loan from "Skeeter" on t... |
||||||
| Ransomware | rottner-tresor.at id32930 View details | Austria | Construction / Real Estate | pending | ||
|
Documents: Rottner Tresor GmbH PROLOGUE An invoice for a 60-minute general anesthesia procedure with... |
||||||
| Ransomware | naturesplus.com id32931 View details | United States | Retail / E-commerce | pending | ||
|
Documents: Natural Organics, Inc. / NaturesPlus PROLOGUE CEO Jim Gibbons, between 2015 and 2019, pur... |
||||||
| Ransomware | pacificabs.com id32932 View details | Australia | Services | pending | ||
|
Documents: Pacific Global Solutions / PABS / Atteign LLC PROLOGUE 40+ American businesses — medical ... |
||||||
| Ransomware | fchhotels.com id32933 View details | Brazil | Hospitality / Food & Beverage / Tourism | pending | ||
|
THE FIRST CALL The company that manages your hotel and calls itself "First Call Hospitality" forgot ... |
||||||
| Ransomware | budgetms.com id32934 View details | Montserrat | IT | pending | ||
|
CLEAN WORK The company that cleans other people's buildings and supplies janitorial products left ev... |
||||||
| Ransomware | sym.com.mx id32935 View details | Mexico | IT | pending | ||
|
SÁNCHEZ Y MARTÍN, S.A. DE C.V.: Critical Incidents and Active Infrastructure PROLOGUE Inside: RFC SM... |
||||||
| Ransomware | ialegre.com id32458 View details | Brazil | Retail / E-commerce | pending | ||
|
Documents Industrias Alegre S.A. — Complete Data Breach PROLOGUE Industrias Alegre S.A. archive cont... |
||||||
| Ransomware | verveportraits.com.au id32451 View details | Australia | Services | pending | ||
|
Verve Portraits Documents PROLOGUE Verve Portraits Pty Ltd archive contains COMPLETE archive of phot... |
||||||
| Ransomware | int.diasorin.com id32452 View details | Italy | IT | pending | ||
|
DIASORIN This article covers only a portion of the data we've chosen to publish. Everything else wil... |
||||||
| Ransomware | hansler.com id32453 View details | Germany | Manufacturing / Engineering | pending | ||
|
EXPOSURE OF MASSIVE DATA BREACH: HANSLER SMITH LIMITED PROLOGUE: Hansler Smith Limited is a fully Ca... |
||||||
| Ransomware | hvlawfirm.com id32454 View details | United States | Finance / Legal / Insurance | pending | ||
|
EXPOSURE OF MASSIVE DATA BREACH: HAGELGANS & VERONIS, LLP PROLOGUE Hagelgans & Veronis, LLP ... |
||||||
| Ransomware | teletekstructures.com id32455 View details | Ukraine | Manufacturing / Engineering | pending | ||
|
A Canadian company builds cell towers across North America. PROLOGUE Teletek Structures Inc. — a Can... |
||||||
| Ransomware | medevolve.com id32456 View details | United States | Healthcare / Pharma | pending | ||
|
MedEvolve: Internal Documents of an American Medical Billing Company PROLOGUE MedEvolve is an Americ... |
||||||
| Ransomware | neolife.com id32445 View details | United States | Retail / E-commerce | pending | ||
|
COMPLETE DATA BREACH Golden Neo Life: Mexican MLM Network with Legal Problems, Financial Collapse an... |
||||||
| Ransomware | buroboot.nl id32446 View details | Netherlands | Services | pending | ||
|
Chapter 1. Scale 1.1 79,344 PDF files Storage structure: Shares\Civiel\Projecten\ ├── A\ │ ├── AALSM... |
||||||
| Ransomware | manhattanloft.co.uk id32356 View details | United Kingdom | Retail / E-commerce | pending | ||
|
Manhattan Loft Corporation Limited Documents PROLOGUE The Manhattan Loft Corporation Limited (also k... |
||||||
| Ransomware | zonarsystems.com id32352 View details | United States | IT | pending | ||
|
Zonar Systems The Company That Knows Where You Are Zonar Systems, Inc. — a Seattle-based company tha... |
||||||
| Ransomware | diversifiedbodyandpaint.com id32345 View details | United States | Manufacturing / Engineering | pending | ||
|
Diversified Body Acquisition, LLC: Internal Documents of a Colorado Auto Body Company PROLOGUE Insid... |
||||||
| Ransomware | howardlumber.com id32346 View details | United States | Retail / E-commerce | pending | ||
|
Howard Lumber Company and Augusta Sash & Door: Internal Documents of a Building Materials Group ... |
||||||
| Ransomware | hatch.group id32347 View details | United Kingdom | Manufacturing / Engineering | pending | ||
|
Hatch Communications: A Leeds PR Agency in the Light of a Data Breach PROLOGUE Inside: registration ... |
||||||
| Ransomware | zayo.com id32348 View details | United States | Telecommunications | pending | ||
|
Zayo Group A cache of corporate data from telecommunications provider Zayo Group has been discovered... |
||||||
| Ransomware | cfsnow.com id32349 View details | Canada | IT | pending | ||
|
Challenge Financial Services, Inc.: Internal Documents of a California Auto Lending Company PROLOGUE... |
||||||
| Ransomware | transcar.com id32350 View details | Germany | Transportation / Travel / Logistics | pending | ||
|
Documents Trans Global Auto Logistics / Transcar Auto Shippers PROLOGUE The archive of Trans Global ... |
||||||
| Ransomware | avkvalves.com id31946 View details | Sweden | — | pending | ||
|
Investigation: Belgicast Internacional S.L. Executive Summary An analysis of more than 10,000 intern... |
||||||
| Ransomware | gt-tele.com id31947 View details | United States | — | pending | ||
|
MJR Technologies / GT Telecom & GT Security: Internal Documents of an American Telecom Contracto... |
||||||
| Ransomware | wcmanagement.info id31877 View details | — | pending | |||
|
Documents of West Coast Management and Realty PROLOGUE Over 1,000 debt collection records with names... |
||||||
| Ransomware | alphanumeric.com id31878 View details | United States | — | pending | ||
|
ALPHANUMERIC SYSTEMS, INC.: Internal Documents of an American IT Company PROLOGUE Internal documents... |
||||||
| Ransomware | am-bition.jp id31879 View details | Japan | — | pending | ||
|
Internal Documents of the AMBITION Group and Its Insurance Partner Hope SSI PROLOGUE AMBITION Co., L... |
||||||
| Ransomware | grecosteel.com id31880 View details | Greece | — | pending | ||
|
How Greco Steel Products Lost Control of Finances and Payroll PROLOGUE: 19 document categories. A co... |
||||||
| Ransomware | makfreight.com id31881 View details | Canada | — | pending | ||
|
M.A.K. Freight Systems: Seven Vulnerabilities of a Canadian Freight Broker PROLOGUE We have in our p... |
||||||
| Ransomware | galmack.com.ec id31766 View details | Ecuador | — | pending | ||
|
GALMACK S.A.: Internal Documents of an Ecuadorian Auto Dealership Holding PROLOGUE Inside: monthly b... |
||||||
| Ransomware | airoyal.biz id31767 View details | — | pending | |||
|
AIROYAL COMPANY: Internal Documents of an American Industrial Components Distributor PROLOGUE We hav... |
||||||
| Ransomware | tiltstudio.com id31768 View details | Germany | — | pending | ||
|
The Tilt Studio Archives Investigation of a Corporate Archive Leak from an Entertainment Network PRO... |
||||||
| Ransomware | powdr.com id31566 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Point of No Return: What the Ski Empire Is Hiding A company that sells adventure, family memories, a... |
||||||
| Ransomware | firstdigital.com id31567 View details | United States | Telecommunications | pending | ||
|
The Digital Cartel: How a Telecom Empire Robs Its Own Customers and Employees A company that sells c... |
||||||
| Ransomware | flowco-inc.com id31568 View details | United States | Manufacturing / Engineering | pending | ||
|
DEEP WELL: Flowco Production Solutions Documents PROLOGUE Payroll records with employee names and po... |
||||||
| Ransomware | oligo.de id31569 View details | Germany | IT | pending | ||
|
A group of companies whose luminaires illuminate Deutsche Bank, Burj Dubai, and Scout Motors' assemb... |
||||||
| Ransomware | profinrg.nl id31563 View details | Netherlands | Energy | pending | ||
|
How Profinergy BV Lost Control of Thousands of Files PROLOGUE: Thousands of files. The complete digi... |
||||||
| Ransomware | advancedtaxsolutions.com id31564 View details | United States | Finance / Legal / Insurance | pending | ||
|
Frank Rim & Associates: Archive of a Tax Consulting Practice PROLOGUE Every tax case. Initial cl... |
||||||
| Ransomware | royalchain.com id30772 View details | Canada | Finance / Legal / Insurance | pending | ||
|
Royal Chain Group: Jewelry Business with Infrastructure for Bypass Operations PROLOGUE The archive f... |
||||||
| Ransomware | menlosystems.com id30773 View details | Germany | Manufacturing / Engineering | pending | ||
|
FREQUENCY COMB ON TWO FRONTS A German company synchronizes time for the Pentagon while simultaneousl... |
||||||
| Ransomware | downies.com id30729 View details | Australia | Retail / E-commerce | pending | ||
|
Downies Collectables Pty Ltd: $1.4M per Month — and $78K in Rent Paid to Itself PROLOGUE We are in p... |
||||||
| Ransomware | samuelkoon.com id30590 View details | United States | Other | pending | ||
|
How Samuel D. Koon & Associates Controls a $25 Million Portfolio and 350+ Bank Accounts PROLOGUE... |
||||||
| Ransomware | acilab.com id30588 View details | Brazil | IT | pending | ||
|
How ACI Financed Its Owners' Companies — and Paid Them Rent PROLOGUE Inside the archive of American ... |
||||||
| Ransomware | torsiongroup.co.uk id30589 View details | United Kingdom | Manufacturing / Engineering | pending | ||
|
END OF THE LINE A company that builds homes and promises safety to its residents failed to protect t... |
||||||
| Ransomware | wtlawllp.co.uk id30376 View details | United Kingdom | Finance / Legal / Insurance | pending | ||
|
WT Law LLP: Internal Documents of a UK Law Firm PROLOGUE Inside: full credit reports with data from ... |
||||||
| Ransomware | gvfsinc.com id30377 View details | United States | Finance / Legal / Insurance | pending | ||
|
GREEN VALLEY: SELF-LEASE SCHEME How a California agricultural distributor pays rent to companies con... |
||||||
| Ransomware | bergdemo.com id30371 View details | Germany | Other | pending | ||
|
Berg / Crushing Corporation of America: Demolition on Federal Money PROLOGUE In our possession are i... |
||||||
| Ransomware | petradiamonds.com id30133 View details | United Kingdom | Retail / E-commerce | pending | ||
|
THE DIAMOND ARCHIVE: Petra Diamonds Limited Documents PROLOGUE A complete employee directory with na... |
||||||
| Ransomware | orion4value.com id30131 View details | Germany | IT | pending | ||
|
THE CERTIFICATE AS A VULNERABILITY: Documents of Orion Registrar Inc. PROLOGUE Financial reports and... |
||||||
| Ransomware | clc-tn.com id30118 View details | United States | NGOs / Associations | pending | ||
|
City Lumber Company: Building Materials in Tennessee — What Lies Behind the Small Sign PROLOGUE In o... |
||||||
| Ransomware | joyconstructionnyc.com id30119 View details | United States | Construction / Real Estate | pending | ||
|
Joy Construction Corp: $1.3 Billion in Affordable Housing — and $8.7 Million to a Shareholder in Six... |
||||||
| Ransomware | wilfley.com id30120 View details | United States | Manufacturing / Engineering | pending | ||
|
SEAL FAILURE A company that builds pumps for chemical and defense production — and undertakes to con... |
||||||
| Ransomware | rcfassoc.com id30130 View details | United States | Finance / Legal / Insurance | pending | ||
|
R.C. FIELDS & ASSOCIATES: Client Data, Hidden Development Risks, and Uninvestigated Security Inc... |
||||||
| Ransomware | owensborograin.com id30113 View details | United States | Agriculture / Food | pending | ||
|
PROCESSING: GRAIN IN SOMEONE ELSE'S MILL PROLOGUE Tax returns filed with the IRS under threat of "fi... |
||||||
| Ransomware | ilex-paysages.com id30114 View details | France | Construction / Real Estate | pending | ||
|
LANDSCAPE ARCHIVE: How Ilex Paysages et Urbanisme Stores Its Own — and Others' — Secrets PROLOGUE Th... |
||||||
| Ransomware | touredge.com id30115 View details | United States | Manufacturing / Engineering | pending | ||
|
The Breaking Point A golf club manufacturer sells precision, durability, and control as a philosophy... |
||||||
| Ransomware | vcnyhome.com id30116 View details | United States | Retail / E-commerce | pending | ||
|
THE VCNY HOME ARCHIVE The company that sells home comfort failed to protect its own home — its inter... |
||||||
| Ransomware | infinedi.net id30117 View details | United States | IT | pending | ||
|
Clearinghouse The company doctors pay to keep their patients' data safe. This article presents only ... |
||||||
| Ransomware | canopybrands.us id30056 View details | Canada | Retail / E-commerce | pending | ||
|
Limit of Travel A holding company that sells people safety at height failed to keep its own data saf... |
||||||
| Ransomware | conduril.pt id30057 View details | Portugal | Construction / Real Estate | pending | ||
|
CONDURIL: WHAT THE COMPANY THAT BUILDS EVERYTHING IS BUILDING PROLOGUE: A FOUNDATION OF PAPER Condur... |
||||||
| Ransomware | hmcfarms.com id30058 View details | United States | Agriculture / Food | pending | ||
|
THE HMC GROUP: OPEN FIELD A California Central Valley agricultural holding feeds America peaches. It... |
||||||
| Ransomware | doosan.com id30059 View details | Korea, Republic of | Manufacturing / Engineering | pending | ||
|
How Doosan / Geith / Bobcat Buries Defects and Protects Its Secrets PROLOGUE: 3.27 TERABYTES OF FILE... |
||||||
| Ransomware | tmscentral.com id30060 View details | United States | Transportation / Travel / Logistics | pending | ||
|
A SIGNAL WITH NO BACKUP: How Total Monitoring Services Sells Multi-Channel Protection and Routes the... |
||||||
| Ransomware | va-glass.com id30061 View details | Holy See (Vatican City State) | Manufacturing / Engineering | pending | ||
|
THE TRANSPARENT MIRROR A company that sells people glass and reflections failed to protect its own r... |
||||||
| Ransomware | pchome.com.tw id30062 View details | Taiwan, Province of China | Retail / E-commerce | pending | ||
|
HOW A TAIWANESE GIANT SOLD OUT ITS CUSTOMERS A payment company sells trust, security, and reliabilit... |
||||||
| Ransomware | dystar.com id30063 View details | Singapore | Manufacturing / Engineering | pending | ||
|
The Complete Digital Archive of DyStar PROLOGUE: WHAT WE HAVE IN OUR HANDS 1.3 terabytes of data — f... |
||||||
| Ransomware | qdi.com id30064 View details | United States | IT | pending | ||
|
HOW QUALITY DINING CONVERTS LOSS INTO PROFIT PROLOGUE: ONE STORY ABOUT FINANCIAL ADJUSTMENTS Quality... |
||||||
| Ransomware | turbodata.com id30065 View details | United States | IT | pending | ||
|
TICKET ISSUED: How Turbo Data Systems Built a Dossier on Half of California From a Slip of Paper Und... |
||||||
| Ransomware | lifevantage.com id30066 View details | United States | Healthcare / Pharma | pending | ||
|
THE NEUTRALIZING FACTOR: How LifeVantage Corporation Profits from Hope and Buries the Truth PROLOGUE... |
||||||