We've just wrapped up the new design, along with a ton of other improvements. Check them all out in the Changelog.

Ransomware Group intelligence

Emperador

Active

Track Emperador with 61 published victims and 1 known leak locations in a single intelligence view.

DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Victims 61 Known published victims in this dataset
First discovered 2026-08-12 Earliest victim discovery date
Last discovered 2026-10-29 Latest victim discovery date
Inactive since 1 days Days since the latest known victim
Top country United States 14 victims
Known locations 1 Leak or negotiation infrastructure tracked

Overview

Emperador is tracked by Dark Eye as a ransomware group with 61 published victims.

United States is currently the most targeted country in this dataset.

1 known leak locations are currently associated with this group.

Leak Status Distribution

  • Leaked 31 50.8%
  • Pending 21 34.4%
  • Deleted 9 14.8%

Top Countries

Interactive distribution based on the currently visible victims list.

Top Countries
Distribution

    Known Leak Locations (1)

    Label Type Availability Links
    Leak location 1 Onion service Down checked 1h ago emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion

    Top Activity Sectors (14)

    Victims (61)

    Search, filter and paginate the victim timeline for Emperador. Showing 1–61 of 61.

    Type Target Discovered Country Business Category Intel Link Leak status
    Ransomware LA PROFUMERIA SRL id35943 View details Spain null pending
    Ransomware MAA Group Consulting Engineers id35910 View details United States Manufacturing / Engineering pending
    Ransomware TWICE SRL id35838 View details Brazil Services pending
    Ransomware Afflelou id35794 View details United States Services pending
    Ransomware TRANSPORTES JIMENEZ and REYES JIM REY S.A. id35575 View details Peru Transportation / Travel / Logistics pending
    Ransomware A-RMS id35556 View details — Other pending
    Ransomware AyT COMPUTERS SRL id35553 View details Czechia IT pending
    Ransomware AB InBev id35544 View details France Hospitality / Food & Beverage / Tourism pending
    Ransomware Frommann Energie GmbH id35538 View details Germany Energy pending
    Ransomware Phoenix S&S GmbH id35539 View details Germany Retail / E-commerce pending
    Ransomware JS Constructor, INC id35478 View details United States Manufacturing / Engineering pending
    Ransomware B2Chat id35450 View details United States IT pending
    Ransomware Bruin Group LLC id35358 View details United States Services pending
    Ransomware GTL Concreto e Logística LTDA id35198 View details Brazil Construction / Real Estate pending
    Ransomware Luzco Ilumination id35024 View details Spain null pending
    Ransomware Electrolux id34074 Sweden Manufacturing / Engineering leaked
    Ransomware SitePro Rentals id34073 Germany Construction / Real Estate leaked
    Ransomware MPI LTDA id33878 View details Brazil — pending
    Ransomware MyM ODONTOCLINICA S.A id33852 View details Brazil — pending
    Ransomware CMC AUDITORES SRL id33803 View details Argentina — pending
    Ransomware Spelman Logistics id33717 View details — — pending
    Ransomware Imperial Diamond Jewellery id33610 View details — — leaked
    Ransomware PANCARIBBEAN LOGISTICS GROUP id33466 View details Trinidad and Tobago Transportation / Travel / Logistics leaked
    Ransomware METROCOLOR S.A. id33465 View details Spain Retail / E-commerce leaked
    Ransomware OMUR HIRDAVAT LTD id33451 View details Türkiye Manufacturing / Engineering leaked
    Ransomware LA PONDEROSA id33361 View details Mexico Other leaked
    Ransomware SitePro Rentals id33335 View details Germany Construction / Real Estate deleted
    Ransomware Polikem id33286 View details Türkiye Manufacturing / Engineering leaked
    Ransomware Amazon Informatica id33248 View details Brazil IT pending
    Ransomware SiteProRentals id33224 View details United States Services deleted
    Ransomware Electrolux 2... id33225 View details Sweden Manufacturing / Engineering leaked
    Ransomware Car Service Abschlepp id33212 View details Germany Transportation / Travel / Logistics leaked
    Ransomware Electrolux & Ontrac id33178 View details — null deleted
    Ransomware OnTrac id33124 View details United States Transportation / Travel / Logistics deleted
    Ransomware RECEITA FEDERAL DO BRASIL id33083 View details Brazil Public Sector leaked
    Ransomware Alabama Woman's Health Care id33016 View details United States Healthcare / Pharma leaked
    Ransomware Studio Notarile Associato Salvatore Costantino E Anna Favarato id33006 View details Italy Healthcare / Pharma leaked
    Ransomware Electrolux id32994 View details Sweden Manufacturing / Engineering deleted
    Ransomware Cassias MG Government id32991 View details Brazil Public Sector leaked
    Ransomware Westbridge Institute of Technology, Inc. id32921 View details United States Education leaked
    Ransomware RDA MOTORS S.P.A. id32915 View details Italy Transportation / Travel / Logistics leaked
    Ransomware SEVENOAKS s.r.o. id32907 View details Czechia Manufacturing / Engineering deleted
    Ransomware Navitrans id32799 View details United States Transportation / Travel / Logistics leaked
    Ransomware Nexbex Solutions Private Limited id32786 View details India IT leaked
    Ransomware EASY JOB S.A.S. id32730 View details Colombia Services leaked
    Ransomware Bosnia and Herzegovina Mine Action Center id32710 View details Bosnia and Herzegovina NGOs / Associations leaked
    Ransomware Universal Starch-Chem Allied Ltd id32708 View details India Manufacturing / Engineering leaked
    Ransomware BAYMER id32709 View details United States Healthcare / Pharma leaked
    Ransomware Judicial Branch of the Province of Jujuy id32591 View details Argentina Public Sector leaked
    Ransomware Uniguacu id32268 View details Brazil null leaked
    Ransomware Hanwha Renewables id32227 View details Korea, Republic of Energy leaked
    Ransomware Ipro.com(revealdata.com) customer DB + full database backup id32202 View details United States IT deleted
    Ransomware Capitol Mechanics id32185 View details United States — leaked
    Ransomware FRUCASTRO SL id32050 View details Spain Manufacturing / Engineering deleted
    Ransomware Vietnam Electricity(EVNHANOI) id31935 View details Viet Nam — pending
    Ransomware TEST id31962 View details — — deleted
    Ransomware NetExam id31924 View details United States — leaked
    Ransomware Prefeitura Municipal de Arcos id31821 View details Brazil — leaked
    Ransomware Albania's Official National Teacher Training Portal id31782 View details Albania Education leaked
    Ransomware Albania's official national teacher training portal. id31781 View details Albania Education leaked
    Ransomware City Government of Baguio id31597 View details Philippines Public Sector leaked