Ransomware Group intelligence

Thegentlemen

Active

Track Thegentlemen with 1056 published victims and 2 known leak locations in a single intelligence view.

DARK EYE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 1056 Known published victims in this dataset

First discovered 2025-09-09 Earliest victim discovery date

Last discovered 2026-10-30 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 228 victims

Known locations 2 Leak or negotiation infrastructure tracked

Thegentlemen is tracked by Dark Eye as a ransomware group with 1056 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

1056

Leaked 15 1.4%
Pending 1041 98.6%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 1	Onion service	Up checked 4h ago	`tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion`
Leak location 2	Onion service	Down checked 4h ago	`i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion`

IT 160
Manufacturing / Engineering 124
Communication / Marketing 89
Healthcare / Pharma 85
Services 78
Retail / E-commerce 72
Finance / Legal / Insurance 58
Construction / Real Estate 50
Transportation / Travel / Logistics 33
Not identified 33
Agriculture / Food 30
Education 29
Public Sector 21
Energy 19
Hospitality / Food & Beverage / Tourism 14
NGOs / Associations 13
Telecommunications 8
null 3
Media / Entertainment 1
Law Enforcement / Public Sector 1
Research 1

Typical Attacks (17)

▼

How Thegentlemen typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via The Gentlemen.

T1583.001 Domains Resource Development

What they do: The Gentlemen has maintained a TOR Data Leak Site (DLS) to post stolen victim data.

What that means: Adversaries may acquire domains that can be used during targeting.
T1585 Establish Accounts Resource Development

What they do: The Gentlemen and its affiliates have leveraged Tox to communicate with victims.

What that means: Adversaries may create and cultivate accounts with services that can be used during targeting.
T1585.001 Social Media Accounts Resource Development

What they do: The Gentlemen has established social media accounts on X.

What that means: Adversaries may create and cultivate social media accounts that can be used during targeting.
T1588.002 Tool Resource Development

What they do: The Gentlemen has provided a custom EDR killing tool called GentleKiller and other like software that abuse vulnerable drivers via the Bring Your Own Vulnerable Driver (BYOVD) technique to their affiliates that attempts to disable EDR solutions.

What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.
T1683.001 Written Content Resource Development

What they do: The Gentlemen has utilized branded code and ransom notes.

What that means: Adversaries may create or tailor written materials to support targeting and malicious operations.
T1683.002 Audio-Visual Content Resource Development

What they do: The Gentlemen has leveraged a branded graphic that is placed on the systems desktop wallpaper that symbolizes the association of malicious activity to the group.

What that means: Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations.
T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: The Gentlemen has leveraged compromised user credentials to gain access to victim hosts.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1190 Exploit Public-Facing Application Initial Access

What they do: The Gentlemen has exploited vulnerable public-facing devices and services to gain access to victim environments.

What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation

What they do: The Gentlemen has assisted affiliates with gaining privilege escalation through the use of BYOVD.

What that means: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1027.002 Software Packing Stealth

What they do: The Gentlemen has packed The Gentlemen Ransomware binaries utilizing either Themida or Enigma to obfuscate the malicious payloads.

What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.
T1036 Masquerading Stealth

What they do: The Gentlemen has fabricated the version information of payload files to evade detection.

What that means: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
T1036.001 Invalid Code Signature Stealth

What they do: The Gentlemen has copied digital signatures from legitimate executables in attempts to circumvent detection.

What that means: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: The Gentlemen has named The Gentlemen Ransomware payload files to resemble well-known software vendors to include security vendors.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1018 Remote System Discovery Discovery

What they do: The Gentlemen has utilized internal network scanning tools to enumerate additional hosts in the victim environment to include Advanced IP Scanner.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1219.002 Remote Desktop Software Command and Control

What they do: The Gentlemen has relied on remote access tools, such as AnyDesk, as a means of maintaining access to victim environment.

What that means: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks.
T1486 Data Encrypted for Impact Impact

What they do: The Gentlemen has used The Gentlemen Ransomware to encrypt victim’s data.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1657 Financial Theft Impact

What they do: The Gentlemen has used double-extortion tactics to sway victims to pay a ransom to include exfiltrating sensitive data, encrypting files, and threatening public release if a payment is not received.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (64)

▼

Software Thegentlemen has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

DumpBrowserSecrets KslKatz Mimikatz

Defense evasion

EDRStartupHinder KslDump PowerRun RedSun ThrottleStop driver (BYOVD)

Discovery

Advanced IP Scanner API-C99-NL Censys CertiHound Gogo MANSPIDER Nmap PrivHound RelayKing-Depth Shodan SoftPerfect NetScan TaskHound

Discovery & enumeration

Advanced IP Scanner API-C99-NL Censys CertiHound Gogo Nmap MANSPIDER PrivHound RelayKing-Depth Shodan TaskHound

Exfiltration

RClone WinSCP

LOLBAS (living-off-the-land binaries)

PsExec

Networking & tunnelling

Amnezia VPN Chisel Cloudflared OpenVPN Proxychains PuTTY Wireguard VPN OpenSSH

OffSec

Impacket NetExec PowerZure RegPwn Responder Titanis Velociraptor ZeroPulse

Offensive security tooling

Impacket NetExec PowerZure RegPwn Responder Titanis Velociraptor ZeroPulse

RMM Tools

AnyDesk FreeRDP MeshAgent

Remote monitoring & management

AnyDesk FreeRDP MeshAgent

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.

Ransom Notes (3)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

README-GENTLEMEN_3.txt txt · 2829 chars

[snip] = YOUR ID

Gentlemen, your network has been encrypted.

1. Any modification of encrypted files will make recovery impossible.
2. Only our unique decryption key and software can restore your files.
Brute-force, RAM dumps, third-party recovery tools are useless.
It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc).
If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.
In addition, it will be reported to the relevant data protection authorities and regulators.
This may result in official investigations, significant fines, and reputational damage for your company.
6. We guarantee 100% file recovery to their original state, bit by bit.
To demonstrate the quality of our work, you can provide three sample files, and we will restore them free of charge.

TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): 13343E50C1B3466F0EA35B5B3E55A044CB7132FD28A8665EFEA0E5848E276D548C21B79F15C2
Download Tox messenger: https://tox.chat/download.html
Contact us (add via SimpleX): https://smp14.simplex.im/a#4mlOiePV8NBXOv2QrZ9CaPeRPm1mBUgxn4SdpFnm978
Download SimpleX https://simplex.chat/downloads/

СONTACT TO PREVENT DATA LEAK (7 DAYS BEFORE YOUR COMPANY DATA WILL BE PUBLISHED IN OUR BLOG, WITH 239 HOURS REVEAL TIMER)
Check our blog: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/
Download Tor browser: https://www.torproject.org/download/
Follow us on X: https://x.com/TheGentlemen26
Clearnet blog link: https://thegentlemen.cc/

Any other means of communication are fake and may be set up by third parties.
Only use the methods listed in this note or on the specified website.
After adding (us) in Tox or Session, please wait for your request to be processed and stay online.
If you do not receive a reply within 36 hours, create another account and contact us again.
In your first message in chat, immediately provide your ID from the note and the name of your organization.
Assign one person as contact responsible for all negotiations. Do not create multiple chats.

We have stolen more than 100 GB of your corporate information from your servers, including critically important data.

Your company is facing a massive information security breach. A total data leak has occurred. This greatly increases the risk of colossal financial and reputational losses.

View on RansomLook

README-GENTLEMEN_2.txt txt · 2467 chars

[snip] = YOUR ID

Gentlemen, your network has been encrypted.

TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): 98C132E2B20B531BE6604397D97040C1E9EB42FCE12EDF119BCE8B4031CA5C70DAF5E65FA3C3
Download Tox messenger: https://tox.chat/download.html
Contact us (add via Session ID): 05809b2da1d5b1a302f48b5767fd1843d54f3c516f9ab0eb26b544ffa73340292e
Download Session https://getsession.org

View on RansomLook

README-GENTLEMEN.txt txt · 1490 chars

[snip] = YOUR ID

Gentlemen, your network is under our full control.
All your files are now encrypted and inaccessible.

1. Any modification of encrypted files will make recovery impossible. 
2. Only our unique decryption key and software can restore your files. 
   Brute-force, RAM dumps, third-party recovery tools are useless.
   It’s a fundamental mathematical reality. Only we can decrypt your data.
3. Law enforcement, authorities, and “data recovery” companies will NOT help you.
   They will only waste your time, take your money, and block you from recovering your files — your business will be lost.
4. Any attempt to restore systems, or refusal to negotiate, may lead to irreversible wipe of all data and your network.
5. We have exfiltrated all your confidential and business data (including NAS, clouds, etc). 
   If you do not contact us, it will be published on our leak site and distributed to major hack forums and social networks.

TOX CONTACT - RECOVER YOUR FILES
Contact us (add via TOX ID): F8E24C7F5B12CD69C44C73F438F65E9BF560ADF35EBBDF92CF9A9B84079F8F04060FF98D098E
Download Tox messenger: https://tox.chat/download.html

COOPERATE TO PREVENT DATA LEAK (239 HOURS LEFT)
Check our blog: http://tezwsse5czllksjb7cwp65rvnk4oobmzti2znn42i43bjdfd2prqqkad.onion/ 
Download Tor browser: https://www.torproject.org/download/

Any other means of communication are fake and may be set up by third parties. 
Only use the methods listed in this note or on the specified website.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (1056)

Search, filter and paginate the victim timeline for Thegentlemen. Showing 901–1000 of 1056.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	NFT Technology id26402 View details	2026-02-10	Taiwan, Province of China	IT	pending
nft.com.tw zoominfo.com/c/nft-technology-co-ltd/447009402 NFT Technology Co Ltd is a company that operates in the Chemicals & Related Products industry. It employs 250to499 people and has 50Mto100M of revenue. The company is headquartered in Gangshan Dist., Kaohsiung City, Taiwan. ID 26402
Ransomware	Museu do Caramulo id26401 View details	2026-02-10	Portugal	Finance / Legal / Insurance	pending
museudocaramulo.pt zoominfo.com/c/museu-do-caramulo/547032458 Museu do Caramulo is a museum that showcases a diverse collection of ancient and modern art, automobiles, motorcycles, bicycles, and toys. It hosts various exhibitions and events, including the Caramulo Motorfestival and the Corrida dos Fundadores, aimed at engaging the community and promoting historical awareness. The museum also offers restoration workshops, classic vehicle insurance, and certification services for vehicles ID 26401
Ransomware	Agis Civil Engineering Construction id26400 View details	2026-02-10	Brazil	Construction / Real Estate	pending
grupoagis.com.br zoominfo.com/c/agis/372423957 Grupo Agis unites three businesses: Agis Construo, one of the top engineering companies in Brazil, Agis Sistemas focused on integrated energy solutions, and Agis Minerao specializing in mineral extraction for civil construction. They operate in both public and private sectors, with expertise in various infrastructure projects including metro, roads, ports, water works, sanitation, and mining. The group is committed to impactful projects that enhance ID 26400
Ransomware	Fgf Colleges & Universities id26399 View details	2026-02-10	Brazil	Education	pending
fgf.edu.br zoominfo.com/c/fgf/1128423083 UNIGRANDE is a higher education institution that offers a wide range of undergraduate programs including Bachelor's and Technological degrees, with courses available in both virtual and face-to-face modalities. The institution aims to provide educational opportunities for students and supports them through various admission processes such as online assessments and ENEM scores. Targeting prospective students, UNIGRANDE facilitates access to quality ID 26399
Ransomware	Area Limpia id26390 View details	2026-02-10	Colombia	Communication / Marketing	pending
www.arealimpia.com.co https://www.zoominfo.com/c/rea-limpia/1332696378 Área Limpia Distrito Capital S.A.S E.S.P provides various cleaning and waste management services including mechanical and manual street sweeping, tree pruning, containerization for waste disposal, and public area washing. The company serves residential and commercial clients, ensuring the collection and transport of non-recyclable waste and maintaining public cleanliness. It aims to enhance urban environments through regular ID 26390
Ransomware	KlearNow.AI id26372 View details	2026-02-08	United States	Transportation / Travel / Logistics	pending
www.klearnow.ai https://www.zoominfo.com/c/klearnowai/566144278 3 TB of data: all correspondence for the last two years, a database dump, all source code. We filed CBP declarations for giants such as BASF, Safran, Sumitomo, etc. KlearNow.AI is on a mission to simplify global trade with AI and ML driven products that make logistics clear, cost-effective, and transparent by transforming B2B supply chains with its smart Logistics as a Service (LaaS) platform. The platform eliminates manual data ent ID 26372
Ransomware	rea Limpia id26368 View details	2026-02-08	Mexico	Communication / Marketing	pending
www.arealimpia.com.co https://www.zoominfo.com/c/rea-limpia/1332696378 Área Limpia Distrito Capital S.A.S E.S.P provides various cleaning and waste management services including mechanical and manual street sweeping, tree pruning, containerization for waste disposal, and public area washing. The company serves residential and commercial clients, ensuring the collection and transport of non-recyclable waste and maintaining public cleanliness. It aims to enhance urban environments through regular ID 26368
Ransomware	CPQ Ingenieros id26266 View details	2026-02-06	Spain	Communication / Marketing	pending
cpqingenieros.com zoominfo.com/c/cpq-ingenieros/404026171 specializes in the design of process plants across various sectors including chemical, pharmaceutical, biotechnological, food, and cosmetic industries. Their services encompass basic processes, detailed engineering, project management, construction supervision, startup assistance, and legal compliance. The company caters to large and medium-sized enterprises committed to quality and transparency. ID 26266
Ransomware	Hafa id26265 View details	2026-02-06	Sweden	Communication / Marketing	pending
hafa.fr zoominfo.com/c/hafa/458792496 Lubricants designed by experts to always go further. This is the HAFA Pioneering Spirit. Since 1953, HAFA has demonstrated its ability to renew itself and accompany you towards ever-greater performance. A single partner with a range of lubricants that meets all my needs. For me, it's HAFA. Hafa offers product ranges that cover all professional uses and simplifies the management of your lubricant needs. ID 26265
Ransomware	Novetex Textiles id26264 View details	2026-02-06	Hong Kong	Construction / Real Estate	pending
novetex.com zoominfo.com/c/novetex-textiles-ltd/105432365 Established in 1976 and part of the Novel Group, Novetex Textiles Limited is a leader in the textile industry, specializing in sustainable fiber and yarn development. The company excels in creating high-quality yarns and fashion collections that align with global trends and market demands. Its operations span multiple cities in China and Asia, serving a range of global high-profile brands. Novetex is committed to eco-friendly ID 26264
Ransomware	Wells Fargo id26263 View details	2026-02-06	United States	Communication / Marketing	pending
fargo.co.ke zoominfo.com/c/wells-fargo-ltd/430303869 Wells Fargo offers comprehensive domestic and corporate security services in Kenya, including guard services, electronic security, fire prevention, valuables in transit, and event security. The company aims to be the preferred supplier of security solutions in Eastern Africa, focusing on innovation and customer satisfaction. With a commitment to adapting to the evolving security landscape, Wells Fargo utilizes advanced technology ID 26263
Ransomware	L'Aeroclub id26262 View details	2026-02-06	France	Education	pending
aeroclub.es zoominfo.com/c/laeroclub/372501174 L'Aeroclub is Europe's biggest general and sports aviation club for people who love flying. They help anyone become a pilot, offering training programs for everything from small private planes to sports aircraft. Whether you want to get your first pilot's license or explore different types of flying, they've got classes and support to help you take to the skies. With locations across Europe, they make learning to fly fun and accessible for aviation ID 26262
Ransomware	Infinite Tiers Group id26258 View details	2026-02-06	United States	IT	pending
itgsoftware.com ITG Software, Inc. is a provider of mission critical integrated business software solutions. Using a rigorous design approach, we build integrated software systems that will have a marked positive effect on the bottom line. Infinite Tiers Group, Inc. has a unique approach to building software systems. This stems from our understanding of the usability and applicability of current technology as well as our vision of what's next. We are committed to providing the highest quality ID 26258
Ransomware	Silvi SRL id26257 View details	2026-02-06	Italy	Manufacturing / Engineering	pending
silvi.it Silvi SRL, established in 1990, specializes in advanced industrial automation solutions, offering a range of products including palletizing systems, depalletizing systems, and special machines. The company serves various sectors such as metal packaging, pet food, automotive, chemical and pharmaceutical, food and beverage, and warehouse logistics. With over 30 years of experience, Silvi SRL is known for its reliability and innovation, providing high-quality customer support ID 26257
Ransomware	Marina Home Interiors id26256 View details	2026-02-06	United Arab Emirates	Communication / Marketing	pending
marinahomeinteriors.com Conceptualized in 1997, Marina Home Interiors Retail Network is a Dubai based premium home furnishings company and operates its stores across the Arabian Gulf region, Egypt and the Indian subcontinent. Marina Home is a household name across the countries it operates in and is synonymous with quality, creativity and a strong aspirational value proposition. Marina has proved its design ability in the selection of items that create an entrancing effect of unusual harmony. ID 26256
Ransomware	Nishiyama Seisakusho id26255 View details	2026-02-06	Japan	Manufacturing / Engineering	pending
nishiyama-ss.co.jp zoominfo.com/c/nishiyama-seisakusho-co-ltd/482975122 Nishiyama Seisakusho Co., Ltd. specializes in the production of precision machinery and components, particularly focusing on high-quality manufacturing since its establishment in 1949. The company offers a range of products including precision gears and mechanical parts, catering to various industries. Their intended clients include businesses in need of reliable and precise mechanical solutions. With a commitment to quality ID 26255
Ransomware	BAM - Brand Art Media id26254 View details	2026-02-06	Germany	Communication / Marketing	pending
bam.lu zoominfo.com/c/bam---brand-art-media/372530213 BAMHUB MEDIA is a tech and design agency that offers a wide range of services including website and app design, software development, 3D design, and branding. They specialize in expo branding, providing end-to-end exhibition services from design to logistics, successfully executing projects in Europe and the USA. Their portfolio showcases work in various areas such as interior design, custom furniture production, and animation. The agency aim ID 26254
Ransomware	Gady Family id26253 View details	2026-02-06	Austria	Agriculture / Food	pending
gady.at zoominfo.com/c/gady-family/431055072 Gady Family is a prominent automotive and agricultural machinery dealer in southeastern Austria, offering a wide range of new and used vehicles including brands like BMW, MINI, Opel, and Toyota. The company also specializes in agricultural machinery and parts, catering to clients in agriculture and farming. With a tradition dating back to 1936, Gady Family has established numerous locations supported by a team of around 500 employees ID 26253
Ransomware	Dome Partners id26252 View details	2026-02-06	United States	Construction / Real Estate	pending
dome.ws zoominfo.com/c/dome-partners/425321491 Dome+Partners specializes in architecture and urban planning, focusing on blending modern aesthetics with functionality. They offer a range of projects including mixed-use developments, cultural institutions, and residential spaces across various countries. The company is committed to sustainability and environmentally-friendly practices, ensuring that their designs harmonize with natural surroundings. Their intended clients include municipalities ID 26252
Ransomware	Chonburi Provincial Administration id26251 View details	2026-02-06	Thailand	Communication / Marketing	pending
chon.go.th official website for the Chonburi Provincial Administration in Thailand. This local government organization manages the Chonburi Province, an area that includes the popular city of Pattaya. Its core functions involve providing local civil services, infrastructure planning, public health initiatives, and promoting regional tourism and the economy. ID 26251
Ransomware	Torus id26250 View details	2026-02-06	United States	Healthcare / Pharma	pending
cfh.money zoominfo.com/c/torus/1313694164 TORUS. Being built to be the world’s leading Neo Wellness Platform, TORUS shall encompass all of wealth, health, education and lifestyle wellness. In short, it will invite users to experience a world of wellness that shall rotate around them. Addressing their every need, every dream and every aspiration. Providing them with infinite investment opportunities, round-the-clock care, multiple avenues to upskill and grow, and the freedom to live the way they ID 26250
Ransomware	PLUS Malaysia Berhad id26249 View details	2026-02-06	Malaysia	Communication / Marketing	pending
plus.com.my zoominfo.com/c/plus-malaysia-berhad/450191982 PLUS Malaysia Berhad provides a comprehensive travel experience through its expressways, offering facilities for relaxation and refreshment along the routes. The company enhances travel convenience with its PLUS App, which includes features like traffic updates, toll fare calculations, and a rewards program called PLUSMiles. Their services are designed for all road users in Peninsular Malaysia, ensuring smooth and safe journeys. ID 26249
Ransomware	EXIM Bank id26248 View details	2026-02-06	United States	Finance / Legal / Insurance	pending
eximbankja.com zoominfo.com/c/exim-bank/101959142 Exim Bank Jamaica provides innovative trade financing solutions, short and medium-term loans, and advisory services aimed at fostering business growth. The bank is dedicated to supporting the productive sector by offering competitively-priced financial products tailored to meet the needs of its clients. Their services include working capital financing, trade credit insurance, and specialized loans for sectors such as tourism and renewable energy. ID 26248
Ransomware	Ankara-İzmir id26247 View details	2026-02-06	Türkiye	Transportation / Travel / Logistics	pending
aniyht.com The Ankara-İzmir High-Speed Railway Line Project (AİYHT) is a significant project under the General Directorate of Infrastructure Investments of the Republic of Turkey's Ministry of Transport and Infrastructure, which will connect Turkey's capital, Ankara, with İzmir, the country's third most populous city. The 503-kilometer-long high-speed railway line will pass through the provincial boundaries of Ankara, Eskişehir, Afyonkarahisar, Kütahya, Uşak, Manisa, and İzmir. ID 26247
Ransomware	Trace id26246 View details	2026-02-06	France	Retail / E-commerce	pending
trace.tv zoominfo.com/c/trace/138903628 TRACE FR is a leading platform for news related to people, music, lifestyle, entertainment, and urban and Afro-urban cultures. The company offers a variety of services including TV channels, radio stations, and mobile applications that cater to diverse audiences. TRACE FR targets clients interested in contemporary culture, music, and lifestyle trends, particularly within the African and urban communities. ID 26246
Ransomware	Far East id26245 View details	2026-02-06	Thailand	Retail / E-commerce	pending
fareastfamelineddb.com zoominfo.com/c/far-east-fame-line-ddb-plc/455777113 Far East Fame Line DDB PLC is a company that operates in the Apparel & Accessories Retail industry. It employs 250to499 people and has 10Mto25M of revenue. The company is headquartered in Phra Nakhon Si Ayutthaya, Phra Nakhon Si Ayutthaya, Thailand. ID 26245
Ransomware	Thin Red Line id26109 View details	2026-02-04	China	IT	pending
https://thinredline.com.cn/ https://www.bloomberg.com/profile/company/2206935D:CH https://www.crunchbase.com/organization/thin-red-line Beijing Thin Red Line Technology is a hardware and software startup founded by Luo Yonghao, initially focused on Augmented Reality (AR) but now expanding into Artificial Intelligence (AI) and AI-native hardware. The company is developing an AI Operating System (AIOS) and software like the "Jarvis" AI assistant for screenless, voice-interactive devices and digit. ID 26109
Ransomware	Handsome Manufacturing id26043 View details	2026-01-31	Hong Kong	Manufacturing / Engineering	pending
www.handsomegroup.com https://www.zoominfo.com/c/handsome-manufacturing-company-ltd/348223586 HANDSOME was established in 1968 in Hong Kong, with expertise in manufacturing OEM plastic items like toys and gifts. Handsome Industrial Company, Limited is a veteran OEM manufacturer that operates as a critical production partner for global entertainment giants like Disney and Marvel, specialized in bringing iconic characters to life through high-quality toys, electronics, and consumer goods. With production facilities in China and Indonesia ID 26043
Ransomware	Nobel Hygiene Pvt id26042 View details	2026-01-31	India	Communication / Marketing	pending
www.nobelhygiene.com https://www.zoominfo.com/c/nobel-hygiene-pvt-ltd/348701217 Nobel Hygiene is a leading manufacturer of disposable hygiene products in India, specializing in adult and baby diapers, as well as women's hygiene products. With over 20 years of experience, the company serves more than 5 million households and exports to over 30 countries. They are known for pioneering the concept of adult diapers in India and have received multiple awards for their manufacturing excellence. Their target clients include families and individuals seeking quality hygiene solutions. ID 26042
Ransomware	Wieson Technologies id26013 View details	2026-01-31	Taiwan, Province of China	IT	pending
www.wieson.com https://www.zoominfo.com/c/wieson-technologies-co-ltd/128565406 Wieson Technologies specializes in the design and manufacturing of connectors and cable assemblies, with a focus on super high-speed technology and wireless communications. Their product range includes interconnect components, wireless components, medical electronics, and automotive electronics. The company serves various industries such as cloud computing, data communication, and medical electronics. Established in 1990, Wieson Technologies aims to provide innovative solutions to clients in need of advanced electronic connectivity ID 26013
Ransomware	Lawsoft id26010 View details	2026-01-31	United States	Finance / Legal / Insurance	pending
https://www.zoominfo.com/c/lawsoft-inc/354268207 lawsoftweb.com www.lawsoft-inc.com LawSoft, Inc. specializes in providing scalable and customizable software solutions for law enforcement agencies, including Computer-Aided Dispatch (CAD), Records Management Systems (RMS), and Fire EMS systems. Their products aim to streamline reporting and data integration, boasting a user-friendly design and incorporating legacy system data for a cohesive experience. The company emphasizes strong customer service with 24/7, US-based support and partners closely with clients to cater to their specific needs. LawSoft targets law enforcement agencies seeking efficient, effective technology to enhance their operational capabilities ID 26010
Ransomware	Hydrometrics id26009 View details	2026-01-31	United States	Communication / Marketing	pending
www.hydrometrics.com https://www.zoominfo.com/c/hydrometrics-inc/18513967 Hydrometrics, Inc. is a Montana-based company that offers professional scientific and engineering services to industrial, commercial, municipal, and private sectors throughout the United States. With over 40 years of experience, they specialize in civil and environmental engineering, water resources and hydrogeology, mine permitting and compliance, and hazardous waste management. Their interdisciplinary approach ensures client satisfaction through reliable and effective solutions tailored to specific project needs. Hydrometrics is committed to empowering environmental responsibility and delivering dependable results. ID 26009
Ransomware	Röben Tonbaustoffe GmbH id26008 View details	2026-01-31	Germany	Communication / Marketing	pending
https://www.roeben.com https://www.zoominfo.com/c/ro%CC%88ben/430636767 Röben specializes in building ceramics, offering a wide range of products including roofing tiles, clinker bricks, and ceramic floor tiles. The company serves architects, contractors, and homeowners, providing not only products but also professional advice and inspiration for construction projects. Their offerings encompass roofing solutions, facade materials, and indoor ceramics with various colors and styles. With a commitment to quality and design, Röben aims to enhance both aesthetic and functional aspects of residential and public buildings ID 26008
Ransomware	Abatix id26007 View details	2026-01-30	United States	Manufacturing / Engineering	pending
https://www.zoominfo.com/c/abatix-corp/99255 www.abatix.com Foundeded in 1983, Abatix is a supplier of products for the general construction, industrial safety, petrochemical, energy, environmental, hospital, fire and water restoration, and disaster response industries supporting customers across the nation and is headquartered in Mesquite, Texas. Established in 1983 and with branch offices in the Atlanta, Baton Rouge, Chicago, Dallas, Houston, Jacksonville, Las Vegas, Los Angeles, Phoenix, San Antonio, San Diego, San Francisco, Sacramento and Seattle areas, Abatix has grown into a nationally recognized supplier of products for the General Construction, Industrial Safety, Petrochemical, Energy, Environmental, Hospital, Fire and Water Restoration, and Disaster Response industries supporting customers across the nation. ID 26007
Ransomware	MBM id25754 View details	2026-01-24	Poland	Communication / Marketing	pending
https://mbm.edu.pl MBM is a Polish company specializing in professional training, compliance support, and implementation of mandatory procedures for both public institutions and private organizations across the country. They have over eight years of experience delivering vocational training, advisory services, audits, and ready‑to‑use documentation tailored to legal requirements, particularly in areas such as data protection and workplace obligations. Their services include courses on personal data protection and assistance in meeting the requirements of current data privacy laws, helping clients align with GDPR‑related duties and other legal obligations concerning handling and safeguarding personal information. ID 25754
Ransomware	Bluemega id25660 View details	2026-01-21	France	Services	pending
www.bluemega.com https://www.zoominfo.com/c/bluemega/352018652 Bluemega specializes in document management and printing infrastructure solutions, aiming to enhance organizational performance through smart printing and e-document services. They offer a range of products including KPAX, PaperCut MF, and various cloud solutions, catering to both public and private sectors. Their target clients include distributors and businesses of all sizes looking to optimize their printing processes and document management. With nearly 30 years of experience, Bluemega supports a network of over 70 distributors and more than 2000 clients worldwide. ID 25660
Ransomware	Sibca id25659 View details	2026-01-21	United Arab Emirates	Communication / Marketing	pending
www.sibca.com https://www.zoominfo.com/c/sibca/67568584 At Sibca we promote a diverse work environment to support the client base and communities that we operate in. With a focus on recruiting our technical team with electrical and computer engineer qualifications from leading universities we have the skills and capabilities to address all our clients' needs. With its roots as a family business we take pride in investing in our employees and their careers at every opportunity. We seek to maximise the potential of all our employees, expand their professional horizons and ask them to contribute positively to the communities in which they operate. We pride ourselves on the fact that the majority of our senior management has risen through our ranks and been able to fulfill their potential. And we are confident that their successors are with Sibca today. ID 25659
Ransomware	Garko id25658 View details	2026-01-21	Czechia	Communication / Marketing	pending
www.garko.cz https://www.zoominfo.com/c/garko/1294349462 Garko helps people make their sports and cultural events special. Based in Brno, they create awesome prizes, trophies, medals, and certificates for every kind of competition. Whether it's a small local tournament or a big regional event, they make sure every participant feels proud and recognized. Their team understands how much a great prize means to athletes and event organizers. ID 25658
Ransomware	Casa de España id25657 View details	2026-01-21	Mexico	Communication / Marketing	pending
www.casadeespana.do https://www.zoominfo.com/c/casa-de-espan%CC%83a/476166997 Casa de España, located in Santo Domingo, Dominican Republic, is a premier private social and cultural club dedicated to preserving Spanish heritage and fostering community ties. The club features extensive facilities, including multiple dining venues like Restaurante Sancho and La Taberna, professional-grade soccer fields, and recreational areas such as the "Camino de la Salud" fitness path. ID 25657
Ransomware	Sincere Corporation id25656 View details	2026-01-21	Japan	Services	pending
Sincerehq.com SINCERE Corporation is a Japanese environmental services company operating under the philosophy of "Symbiosis with Nature," offering "one-stop" solutions in waste management and building maintenance across four main segments: Resource Cycling, Recycling Business, Environmental Improvement and Building Maintenance, and Environmental Consulting. Established in 1969, the company contributes to Japan's circular economy with nationwide operations, including major facilities in Shinagawa and Yokohama. ID 25656
Ransomware	Unimed Anápolis id25655 View details	2026-01-21	Brazil	Healthcare / Pharma	pending
Unimed as a whole is a physician-owned healthcare and health insurance cooperative in Brazil, one of the largest of its kind in the world, operating through many regional cooperatives and serving millions of beneficiaries with managed healthcare services. Unimed Anápolis is part of Unimed, a large Brazilian medical cooperative and health insurance provider. It offers a variety of healthcare plans tailored to people and companies in the region, giving members access to a broad network of affiliated doctors, hospitals, and medical services. The plans are designed to meet different needs and include coverage through a wide accredited healthcare network unimedanapolis.com.br ID 25655
Ransomware	SASI JSC id25652 View details	2026-01-20	Viet Nam	Manufacturing / Engineering	pending
sasi.vn - SASI (Saigon Auto Supporting Industry JSC) is a Vietnamese industrial manufacturing company operating via the domain sasi.vn, focused on large-scale OEM production.SASI is a long-established manufacturer, founded in the 1970s, with production facilities located in Ho Chi Minh City (Cu Chi Industrial Park), which is an important industrial zone for heavy and precision manufacturing in Vietnam.The company’s core activity is OEM and supporting industry manufacturing, meaning it produces metal parts, components, and assemblies strictly according to customer specifications rather than selling consumer products under its own brand.SASI plays a critical role in automotive and industrial supply chains, supplying components used in vehicles, motorcycles, industrial machinery, and selected medical and technical equipment. ID 25652
Ransomware	Autofinanciera id25651 View details	2026-01-20	Colombia	Finance / Legal / Insurance	pending
www.autofinanciera.com.co https://www.zoominfo.com/c/autofinanciera/474531250 Autofinanciera offers a unique program for purchasing goods and services without bank interest, featuring flexible terms and fixed payments. The company aims to help clients achieve their dreams by providing a structured savings plan that allows for the acquisition of vehicles, education, travel, and home renovations. Their target clients include individuals looking to invest in their future and fulfill personal goals through a planned savings approach. Autofinanciera emphasizes financial tranquility and the development of good financial habits for its customers. ID 25651
Ransomware	CPF Financial Services id25650 View details	2026-01-20	Kenya	Finance / Legal / Insurance	pending
cpf.or.ke https://www.zoominfo.com/c/cpf-financial-services-ltd/434613110 CPF Financial Services is a financial institution that specializes in pension fund administration, management consulting, corporate training, and trust fund administration. They offer a range of products including M-Pension, defined contribution schemes, and post-retirement medical schemes. The company aims to provide innovative and sustainable financial solutions to its stakeholders, focusing on enhancing financial security and opportunities. Their intended clients include individuals and organizations seeking comprehensive financial services and retirement planning. ID 25650
Ransomware	Orlík Compressors id25649 View details	2026-01-20	Czechia	Communication / Marketing	pending
www.orlik.cz https://www.zoominfo.com/c/orli%CC%81k-compressors/399403693 Orlik specializes in the production and sale of compressors and related accessories, offering a range of piston, screw, and spiral compressors, as well as dryers and pneumatic tools. Their products are designed for industrial use, emphasizing high efficiency, reliability, and low maintenance requirements. In addition to product sales, Orlik provides services related to compressed air, including rental, servicing, and air consumption audits. Their intended clients include various industrial sectors that require reliable compressed air solutions. ID 25649
Ransomware	USTAR id25648 View details	2026-01-20	China	Communication / Marketing	pending
www.ustar.co.th https://www.zoominfo.com/c/ustar-cosmetics/458875985 USTAR specializes in beauty products that enhance women's appearance and confidence, offering high-quality items at affordable prices. Their product range includes cosmetics for the eyes, face, and lips, such as foundations, lipsticks, and skincare creams. USTAR aims to cater to women's fashion, beauty, and lifestyle needs. The company is committed to providing friendly service and support to its clients. ID 25648
Ransomware	Magen Eco Energy id25647 View details	2026-01-20	Israel	Energy	pending
www.magen-ecoenergy.com https://www.zoominfo.com/c/magen-eco-energy/346848999 MAGEN eco-ENERGY, an Israeli-based global manufacturer of renewable energy solutions, is the parent company of the Magen International Group. In the nearly forty years since the company was founded, MAGEN eco-ENERGY has grown into a world leader specializing in the R&D, production, and marketing of ecological, economical solutions for each of its major product lines: Solar Heating for Swimming Pools, spas and Jacuzzis, Solar Water Heating Systems for domestic and commercial use, Natural Salt Chlorinators, Industrial & Agricultural Heat Exchangers and Pre-Heating solutions. Magens' known brands are: Heliocol®, Sunstar®, eco-Flare®, eco-Spark®, and Heat-Kit. Committed to quality, the company is ISO 9001:1973 and ISO 14001:2004 approved. ID 25647
Ransomware	WRP Asia Pacific Sdn Bhd id25646 View details	2026-01-20	Malaysia	Communication / Marketing	pending
www.wrpworld.com https://www.zoominfo.com/c/wrp-asia-pacific-sdn-bhd/346914589 WRP is one of the world's leading manufacturing and distributing groups producing premium quality gloves for the medical, dental, food and critical environment market. Headquartered in Malaysia, WRP's manufacturing facilities are located in Malaysia and Indonesia. We implement a quality assurance program which is consistent with US FDA's latest Quality System Regulation (QSR) guidelines, and our manufacturing and quality systems are certified to EN ISO 9001 standard. Our products are in full compliance with ASTM standards as well as the European Medical Device Directive 93/42/EEC and, where such is the case, with the national standard transposing harmonized standards EN455 Parts 1, 2 & 3. In order to serve our customers better, we have established a marketing office located in Uniontown, Ohio. ID 25646
Ransomware	Witzenberg Municipality id25645 View details	2026-01-20	South Africa	Public Sector	pending
www.witzenberg.gov.za https://www.zoominfo.com/c/witzenberg-municipality/430430424 Witzenberg Municipality is located in the Cape Winelands District, comprising the towns of Ceres, Tulbagh, Wolseley, Op-die-Berg, and Prince Alfreds Hamlet. The municipality is known for its agricultural production, including deciduous fruits, vegetables, and wine, and has established itself as a family tourist destination and adventure tourism hub. It offers a variety of activities such as historical tours, hiking, and nature experiences. The intended clients include tourists seeking adventure and families looking for recreational activities in a picturesque setting. ID 25645
Ransomware	Sita Sud id25644 View details	2026-01-20	Italy	Transportation / Travel / Logistics	pending
www.sitasudtrasporti.it https://www.zoominfo.com/c/sita-sud-srl/533466307 SITA SUD operates in the field of passenger transport by road in Southern Italy, covering the regions of Campania, Basilicata, and Puglia. The company offers various services including local and long-distance public transport, tourism, vehicle rentals, and freight forwarding. It was established from the division of SITA S.p.a., which has a history dating back to 1912, focusing on local public transport activities. Its intended clients include local commuters, tourists, and businesses seeking transportation services. ID 25644
Ransomware	Rola Motor Group id25643 View details	2026-01-20	South Africa	Communication / Marketing	pending
www.rola.co.za https://www.zoominfo.com/c/rola-motor-group/479741917 Rola Motor Group specializes in the sale of new, demo, and quality pre-owned vehicles, offering a seamless online finance pre-approval process. They provide services for buying and selling cars, as well as vehicle servicing across various brands. Their intended clients include individuals looking to purchase vehicles, sell their cars, or seek financing solutions. Established in 1963, Rola Motor Group is known for its exceptional customer service and a wide range of automotive solutions. ID 25643
Ransomware	Paltrack id25642 View details	2026-01-20	South Africa	IT	pending
https://www.zoominfo.com/c/paltrack-ltd/429817972 www.paltrack.co.za Paltrack is a leading supplier of software solutions, product coding and integration services to the South African agricultural industry. Our focus is on supply chain visibility from producer to port, and we build and source software solutions that meet our unique customer's needs through all market verticals. Our primary clients are in the fruit and aquaculture industries, but our software is agile and customisable for most traceability requirements. ID 25642
Ransomware	Lotus Bedding id25641 View details	2026-01-20	Thailand	Communication / Marketing	pending
www.lotusbedding.com https://www.zoominfo.com/c/lotus-bedding/357889420 LOTUS is Thailand's leading and most exciting bedding company. At LOTUS, inspiration comes alive through artistic expression by Lotus Design Lab. Your bed will be livened up in style with our exciting design proposals and vast collection of bedding fashion. Established in 1980, the company started off as a tiny workshop doing cut and sew using merely 3 staffs including both founders, Mr. Kamthorn and Mrs. Leena Lojanagosin. Today LOTUS is not merely having over a thousand enthusiastic staffs in the family, but it has grown into multi-national group of companies and expanded its bases to many significant markets including Belgium, Singapore, Hong Kong, to name a few. Moreover, Lotus Bedding Group has successfully diversified its business portfolio to covering other industries such as mattress, hygiene home service, ultra luxury import furniture, retail, transit media provider, aesthetic and holistic hospital, public bus transportation in Bangkok area, and real-estate development. ID 25641
Ransomware	Shtainmetz Aminoach id25640 View details	2026-01-20	Israel	Finance / Legal / Insurance	pending
www.cpa.co.il https://www.zoominfo.com/c/shtainmetz-aminoach--co/447493108 Shtainmetz Aminoach is a leading accounting firm in Israel with 38 years of experience, located in Tel Aviv, and recognized among the top firms in the country. The firm specializes in a wide range of accounting services, including tax planning, international taxation, and financial consulting, catering to large and sophisticated corporations. With a team of experts, including former tax authority officials, they provide tailored solutions for various sectors such as high-tech, real estate, and e-commerce. Additionally, they are part of the global UHY network, enhancing their international service capabilities. ID 25640
Ransomware	BIB Insurance Brokers id25639 View details	2026-01-20	United Kingdom	Finance / Legal / Insurance	pending
https://www.zoominfo.com/c/bib-insurance-brokers-sdn-bhd/372899696 www.bib.com.my BIB Insurance Brokers Sdn Bhd, established in 1976, offers a wide range of insurance products and services including personal, business, and specialty insurance, as well as risk solutions and consultancy. The company serves various sectors such as aviation, oil and gas, and construction, catering to both individual and corporate clients. With a strong partnership network and a commitment to regional expansion, BIB provides expert broking services and claims management solutions. Their focus on delivering global standard insurance consultancy positions them as a trusted partner in risk management. ID 25639
Ransomware	Ayuntamiento de Beniel id25638 View details	2026-01-20	Spain	Public Sector	pending
beniel.es Ayuntamiento de Beniel is the local government authority of the town of Beniel, located in the Region of Murcia, Spain.It is responsible for the administration and governance of the municipality. The organization provides public and administrative services to local residents. Its duties include population registration and issuing official certificates and documents. It manages the municipal budget, local taxes, and public spending. The municipality oversees urban planning, infrastructure, and public maintenance. It coordinates social services, cultural initiatives, and sports programs. The local government organizes and supports community events and public celebrations. It publishes official announcements, regulations, and municipal news. ID 25638
Ransomware	British School of Brasilia id25637 View details	2026-01-20	Brazil	Education	pending
https://www.zoominfo.com/pic/british-school-of-brasilia/452874642 www.britishschoolbrasilia.org The British School of Brasilia (BSB) offers a contemporary British international education from Early Years Foundation Stage onward. As part of the British Schools Foundation, BSB aims to provide high-quality learning experiences and promotes student engagement through various clubs and events. The school caters to a diverse community, welcoming both local and expatriate families seeking a robust educational framework. Furthermore, BSB emphasizes cultural celebrations and community engagement, creating an inclusive environment for all students. ID 25637
Ransomware	Eurotex id25636 View details	2026-01-20	Türkiye	Communication / Marketing	pending
Eurotex operates in Türkiye as a textile manufacturer focused on filament yarns and related textile solutions. Public company profiles describe it as a fiber, yarn, and thread mills business with headquarters in İstanbul and operations in Çorlu, Tekirdağ, serving industrial textile markets. Its website presents products such as polyamide, polyester, specialty, and sustainable yarns for diverse textile applications. In threat-intelligence listings, www.eurotex.com.tr was listed as a ransomware victim associated with thegentlemen. ID 25636
Ransomware	[Redacted] #1930 id25723 View details	2026-01-20	Türkiye	Other	pending
[Redacted] ID 25723
Ransomware	San Carlo Gruppo Alimentare id25614 View details	2026-01-20	Italy	Communication / Marketing	pending
www.sancarlo.it https://www.zoominfo.com/c/san-carlo-gruppo-alimentare-spa/348425917 SAN CARLO is a renowned brand specializing in the production of high-quality snacks, particularly potato chips and other savory snacks. The company focuses on delivering exceptional taste and quality, appealing to a wide range of consumers who enjoy indulgent snack options. With a commitment to innovation and sustainability, SAN CARLO aims to meet the evolving preferences of its customers. Their products are widely available in various retail outlets, catering to both local and international markets. ID 25614
Ransomware	Kontena Nasional Berhad id25613 View details	2026-01-20	Malaysia	Transportation / Travel / Logistics	pending
www.kn.com.my https://www.zoominfo.com/c/kontena-nasional-berhad/405980620 Kontena Nasional Berhad (KNB) is Malaysia's premier logistics company with over 50 years of experience in logistics operations, specializing in integrated solutions such as haulage, freight forwarding, and project logistics. The company offers a comprehensive range of services including transportation and distribution, customs brokerage, and cold chain solutions, catering to various industries across multiple regions. KNB is recognized for its commitment to providing tailored logistics solutions and real-time visibility of cargo movements. Its clientele includes businesses requiring efficient and reliable supply chain management, particularly in cross-border transportation within Southeast Asia. ID 25613
Ransomware	PAO HWA TRADING LTD id25609 View details	2026-01-19	Taiwan, Province of China	Manufacturing / Engineering	pending
https://www.paohwa.com/ PAO HWA TRADING CO., LTD is a leading Taiwanese importer and distributor of comprehensive cutting tools for industries including automotive, aerospace, electronics, and mold manufacturing. The company serves as a general agent for brands such as Japan's KYOCERA and a distributor for NACHI. ID 25609
Ransomware	Dongguan HYX Industrial id25556 View details	2026-01-16	China	Manufacturing / Engineering	pending
https://en.hoyxn.com https://hyx.manufacturer.globalsources.com/homepage_6008838389834.htm https://www.facebook.com/Cables.Speakers/ https://freshdi.com/supplier/Dongguan-HYX-Industrial-Co-Ltd--DblXWk 25+ Years of Manufacturing Experience Founded in 1998, HYX (Dongguan HYX Industrial Co., Ltd.) is a professional OEM & ODM manufacturer specializing in 3C digital accessories, integrating R&D, design, production, and mass manufacturing. With over 25 years of experience, we support global customers with stable quality, reliable capacity, and long-term manufacturing solutions. BSCI, ISO 14001, ISO/TS 16949, EICC, and ISO 9001 Certifications ID 25556
Ransomware	Rogers Capital id25508 View details	2026-01-14	Mauritius	Services	pending
https://www.zoominfo.com/c/rogers-capital-ltd/444888383 https://rogerscapital.mu/ Mauritian company offering integrated financial and technology solutions, including corporate/trust services (fiduciary), IT/telecoms, and consumer finance (credit), helping businesses and individuals navigate global financial landscapes with services like fund administration, tech support, and payroll outsourcing. They operate in diverse sectors, leveraging technology and local expertise to serve both the Mauritius International Financial Centre (IFC) and broader global markets. Rogerscapital.mu blatantly disregarded the security of its company and its clients and did not even attempt to resolve the issue, despite the incompetence of its employees. ID 25508
Ransomware	Real Tech id25430 View details	2026-01-11	Canada	IT	pending
https://www.realtech-eg.com Real Tech for the manufacture of electrical and household appliances. A leading company in the manufacture of electrical and household appliances. Real Tech was established in Egypt in 2010 with the help of young people with a high level of technical experience and the highest scientific degrees, and the manufacture of high quality products at reasonable prices suitable for all spectrums of consumers. These factories are concentrated in Egypt in New Salhia City, First Industrial Zone ID 25430
Ransomware	Dsm Information Technology Trade Ltd. id25429 View details	2026-01-11	United Kingdom	IT	pending
https://dsmbilisim.com.tr Cloud Computing Solutions , IT Security Solutions, Client and Workstations Solutions, Virtualization Solutions, Server and Data Systems Solutions DSM Bilişim enables you to make reliable technology decisions and achieve your goals with permanent solutions for your IT organization. ID 25429
Ransomware	Pos Bilişim Teknolojileri id25428 View details	2026-01-11	Türkiye	Communication / Marketing	pending
https://www.zoominfo.com/c/pos-bilis%CC%A7im-teknolojileri/459191643 www.posbilisim.com Pos Bilişim is a leading company in the Automatic Identification and Data Collection sector in Turkey, established in 2012. They offer a wide range of products including handheld terminals, barcode readers, printers, and industrial PCs, partnering with brands like Honeywell, Zebra, and TSC. The company provides tailored solutions for various sectors such as retail, logistics, and public services, focusing on enhancing operational efficiency and performance. With a strong financial background and a dedicated team, Pos Bilişim aims to deliver high-quality products and services to its clients. ID 25428
Ransomware	Dekoyap id25424 View details	2026-01-11	Türkiye	Retail / E-commerce	pending
https://www.zoominfo.com/c/dekoyap/471786353 www.dekoyap.net Dekoyap is a company that operates in the Retail industry. It employs 10to19 people and has 1Mto5M of revenue. The company is headquartered in Kocasinan/kayseri, Turkey. In our 15,000 m² area, which is the largest building decoration store in Europe , we offer high quality ceramics, stylish parquets, modern sanitary ware products, stylish bathroom cabinets. ID 25424
Ransomware	Warka Bank for Investment and Finance id25423 View details	2026-01-11	Iraq	Finance / Legal / Insurance	pending
www.warka-bank.com warkabank.iq Warka Bank is a financial institution that offers a range of banking services including personal and business accounts, loans, and investment options. The bank aims to serve individual customers, small to medium-sized enterprises, and corporate clients. With a focus on providing accessible financial solutions, Warka Bank is committed to fostering economic growth in the communities it serves. Its services are designed to meet the diverse needs of its clientele, ensuring convenience and reliability. https://www.zoominfo.com/c/warka-bank-for-investment-and-finance/347481400 ID 25423
Ransomware	Hog Slat id25422 View details	2026-01-11	United States	Agriculture / Food	pending
https://www.zoominfo.com/c/hog-slat-inc/48483868 https://www.zoominfo.com/c/hog-slat-inc/406568064 Hog Slat, Inc. is the largest contractor and producer of equipment for hog farmers in the United States, employing approximately 1,000 direct employees and an additional 1,400 subcontractors for construction projects. The company specializes in building turnkey facilities for both family farms and large agricultural units across the U.S. and internationally. Hog Slat also sells equipment packages to clients who prefer to construct their own facilities. Their services cater to a wide range of agricultural clients focused on livestock production. Hog Slat was founded in 1969. This company provides the manufacturing and installation of fans for confinement type hog units. Their headquarters are located in Newton Grove, North Carolina. ID 25422
Ransomware	DTI Foreign Trade Service Corps id25421 View details	2026-01-11	Philippines	Services	pending
https://www.zoominfo.com/c/dti-foreign-trade-service-corps/94388788 www.dti.gov.ph The Department of Trade and Industry (DTI) Philippines aims to foster a globally competitive and innovative industry and services sector that supports inclusive growth and job creation. It provides various programs and services to assist micro, small, and medium enterprises (MSMEs) in their development and resilience. The DTI also engages in international trade agreements and partnerships to enhance the country's economic ties. Its intended clients include businesses, entrepreneurs, and consumers seeking support and guidance in trade and industry matters. ID 25421
Ransomware	Wamtechnik id25352 View details	2026-01-07	Poland	IT	pending
www.wamtechnik.pl https://www.zoominfo.com/c/wamtechnik-ltd/398138337 Wamtechnik specializes in the production and distribution of batteries and accumulator packs, focusing on lithium-ion technology and other battery types for industrial applications. The company offers tailored battery solutions and professional consulting services for various sectors, including automotive, medical, and industrial electronics. With over 30 years of experience, Wamtechnik has established itself as a leading manufacturer in the battery systems industry, collaborating with global leaders like Panasonic and LG Chem. Their commitment to quality and safety ensures reliable power solutions for a wide range of devices. ID 25352
Ransomware	Systherm Grupa id25351 View details	2026-01-07	Poland	Manufacturing / Engineering	pending
https://www.systherm.pl https://www.emis.com/php/company-profile/PL/Systherm_Danuta_Gazinska_sp_j_en_3366600.html SYSTHERM Chłodnictwo i Klimatyzacja sp SYSTHERM Technik sp SYSTHERM Danuta Gazińska sp. Export and import of components for refrigeration and air conditioning, publishing activities, installation and service of refrigeration and air conditioning equipment. ID 25351
Ransomware	Hart id25350 View details	2026-01-07	Poland	Communication / Marketing	pending
https://hartphp.com.pl https://www.zoominfo.com/c/hart-sp-zoo/469629635 HART was founded in 1990 specialize in the wholesale of parts and accessories for passenger cars, vans and motorcycles, also offering workshop equipment and electric scooters. In addition to goods from renowned suppliers, HART also offers of equally high quality, including in particular private label products: HART, HART Premium, M.Line, e-HART, Presspower and Sigert. HART Sp. z o.o. ID 25350
Ransomware	Complexul Energetic Oltenia id25346 View details	2026-01-06	Romania	Energy	pending
www.ceoltenia.ro https://www.ceoltenia.ro/en/despre/profil/date-financiare/ https://www.zoominfo.com/c/complexul-energetic-oltenia-sa/372669392 Complexul Energetic Oltenia is a Romanian energy company established on May 31, 2012, following the government's decision to reorganize the energy sector through the merger of several energy-producing companies. The company focuses on sustainable energy production and aims to ensure safety and professionalism in its operations. Its services include energy supply and commercialization, as well as investments in energy efficiency and development. The intended clients are diverse, including both residential and commercial sectors seeking reliable energy solutions. ID 25346
Ransomware	Stewart Engenharia id25225 View details	2025-12-30	Brazil	IT	pending
www.stewartengenharia.com.br https://www.zoominfo.com/c/stewart-engenharia/546688997 Stewart Engenharia specializes in high-standard constructions and renovations, providing exceptional project development and execution services since 1995. The company is committed to making clients' visions a reality with a focus on sophistication, style, technology, and innovative solutions. With a highly trained team, they cater to the specific demands of discerning clients, offering personalized service. Their portfolio includes the development of refined projects for houses, apartments, offices, and commercial spaces. ID 25225
Ransomware	BioNet-Asia id25220 View details	2025-12-30	Thailand	Communication / Marketing	pending
https://bionet-asia.com/ https://www.zoominfo.com/c/bionet-asia-co-ltd/346273011 BioNet is a vaccine manufacturer focused on developing recombinant and mRNA vaccines to combat respiratory diseases and other public health challenges globally. With over 25 years of experience, BioNet has successfully advanced multiple proprietary recombinant pertussis vaccines to licensure and is currently expanding its commercial operations worldwide. The company follows stringent manufacturing practices and is committed to continuous quality improvement in its vaccine production processes. BioNet aims to address critical immunization needs in regions like Southeast Asia through strategic partnerships and innovative vaccine technologies. ID 25220
Ransomware	Usina Sao Jose Do Pinheiro id25054 View details	2025-12-24	Brazil	Agriculture / Food	pending
www.usjp.com.br https://www.zoominfo.com/c/usina-sao-jose-do-pinheiro/465258703 Located in the municipality of Laranjeiras, Sergipe State, the São José do Pinheiro Sugar Mill is a century-old company that provides excellent service in the commercialization and manufacture of sugar, alcohol, molasses, and energy generation for the entire Brazilian Northeast and some European and African countries Its formation stems from the founding of the São José sugar mill along with other mills in the region by Albano do Prado Pimentel Franco, as recorded in his inventory dated 1928. Recently, in the 2014/2015 harvest, Usina Pinheiro achieved its largest agricultural harvest, harvesting 1,032,155 tons of sugarcane. This harvest also saw the highest ethanol production, totaling 9,140,830 liters of hydrated alcohol and 15,311,764 liters of anhydrous alcohol. The constant pursuit of quality and concern for food safety led Usina Pinheiro to obtain the ISO 9001:2008 and ISO 22000:2005 certifications ID 25054
Ransomware	Ever Green Industria e Comercio Ltda id25053 View details	2025-12-24	Brazil	Healthcare / Pharma	pending
www.evergreen.com.br https://www.zoominfo.com/c/ever-green-industria-e-comercio-ltda/426965047 Ever Green Industria e Comercio Ltda is a company that operates in the Animals & Livestock industry. It employs 250to499 people and has 10Mto25M of revenue. The company is headquartered in Sao Bernardo do Campo, Sao Paulo, Brazil. Products are sold in Brazil, Latin America, and Africa, in food retail (wholesalers and retailers), the pharmaceutical channel, the hospital channel, and the institutional channel. Ever Green's products are present in more than 130,000 points of sale. Founded in 1987, Ever Green operates in the Brazilian and international markets ID 25053
Ransomware	All Rush id25052 View details	2025-12-24	Canada	Communication / Marketing	pending
www.allrush.ca https://www.zoominfo.com/c/all-rush/5705893 AllRush is a full-service print shop located in Calgary, specializing in a variety of products including print materials, custom apparel, small and large format signage, and promotional products. They cater to clients of all sizes, providing quick turnaround times and high-quality branding solutions such as corporate wear, event tickets, and promotional items. Their expertise spans across various printing services and mailing capabilities, ensuring comprehensive support for marketing strategies. With over 20 years of experience, AllRush emphasizes timely delivery and exceptional customer service ID 25052
Ransomware	Santa Casa de Assis id25051 View details	2025-12-24	Brazil	Healthcare / Pharma	pending
www.santacasadeassis.org.br https://www.zoominfo.com/c/santa-casa-de-assis/425726597 Santa Casa de Assis is a longstanding private health care institution in Assis, São Paulo, Brazil. Founded in 1919 and now holding the CEBAS (Certificate of Beneficent Entity in Social Assistance in Health), it operates one of the region’s most complete and modern hospital complexes, offering services such as emergency care, maternity, surgical and intensive care units, advanced orthopedics, hemodynamics, laboratory diagnostics, and specialized clinics. ID 25051
Ransomware	Solus Tecnologia em Sistemas LTDA id25050 View details	2025-12-24	Brazil	Communication / Marketing	pending
www.solustecnologia.com https://www.zoominfo.com/c/solus-tecnologia-em-sistemas-ltda/462475393 Solus Tecnologia specializes in security monitoring by developing and installing closed-circuit television (CCTV) systems. They offer comprehensive and efficient access control solutions and provide structured cabling services ensuring optimal performance and organization of network infrastructure. Additionally, they cater to various telecommunication needs, from simple to complex installations. Since 2000, their main goal has been to meet client expectations, providing comfort, peace of mind, and security. ID 25050
Ransomware	HSR Specialist Researchers id25049 View details	2025-12-24	United Kingdom	Services	pending
hsr.specialistresearchers.com.br https://www.zoominfo.com/c/hsr-specialist-researchers/372422527 HSR Specialist Researchers is the largest independent market research company in Brazil, offering specialized research services across various sectors including automotive, education, finance, healthcare, telecom, technology, and retail. They provide innovative solutions for market research needs, such as exploratory studies, product launches, and customer experience analytics. Their robust multi-platform data collection structure supports a wide range of output types, from simple data bases to comprehensive analytical reports. HSR aims to empower businesses by delivering strategic insights to enhance decision-making and market positioning. ID 25049
Ransomware	********.com id24939 View details	2025-12-19	—	Communication / Marketing	pending
Leading provider of tools and expert advice sports betting. They offer a comprehensive suite of simulation tools, projections, and data for various sports including NFL, NBA, MLB, and more. ID 24939
Ransomware	Flavor Producers id24921 View details	2025-12-19	United States	Communication / Marketing	pending
https://flavorproducers.com/ https://www.zoominfo.com/c/flavor-producers-inc/23530808 Flavor Producers is a leading manufacturer specializing in organic, natural, and plant-based flavors and extracts. The company focuses on creating new taste experiences tailored for food, nutrition, and beverage applications, addressing the growing consumer demand for transparency and quality. Through innovative technologies and a versatile portfolio, Flavor Producers offers a variety of flavor profiles to inspire culinary creativity. Their services cater to manufacturers seeking to enhance their products with superior taste solutions. Full customer database and a lot of additional info. ID 24921
Ransomware	Solumek id24912 View details	2025-12-19	United States	Services	pending
www.solumeksa.com https://www.zoominfo.com/c/solumek-sa/426355528 Solumek SAS specializes in providing comprehensive solutions that range from photovoltaic solar energy to roadway management and innovative technology. Their services include environmental management, road safety strategies, energy solutions, and the design and construction of Construction Development Areas (CDAs) while ensuring compliance and quality. They are focused on enhancing mobility and safety through strategic partnerships, such as their work with the National Road Safety Agency and regional transport authorities. Solumek is committed to sustainability and improving the quality of life in communities by implementing solar energy solutions in rural areas and measuring emissions from mobile sources. ID 24912
Ransomware	*****.com id24720 View details	2025-12-12	—	Retail / E-commerce	pending
The entire infrastructure of a major regional retail grocery network—comprising approximately 80 grocery stores, about 40 liquor outlets, and roughly 50 pharmacies, along with its franchise operations—has been compromised, with all data stolen and encrypted. The targeted company reports an annual revenue of $1.4 to $1.8 billion (according to various 2025 estimates). The exfiltrated data includes all insurance payouts (even detailed records of payouts to families of deceased employees, listing cause of death and amounts paid), complete personnel records for all employees and executives (containing SSN, date of birth, full name, address, passport details, and W-9 forms), every financial document, records of active deals and income/expenses, as well as all documentation and insurance records for the company's movable and immovable property. http://i2ohjeeqe37jre4f2u7pyq73cbm6lecumdxapkvrlryna6rc3it4zsid.onion (your key in Tox Chat) ID 24720
Ransomware	*.* LAST TIMER UPDATE id24683 View details	2025-12-10	—	Finance / Legal / Insurance	pending
1.5 terabytes of data stolen from one of Asia's largest investment companies, with more than 10 billion USD under management. The stolen data includes: 1. Investment documentation: private placement memorandums, investment memos (Pre-IC/Final-IC), financial models and project budgets 2. Investor database (LP): complete limited partner information, investment terms, contacts, non-disclosure agreements 3. Portfolio companies: financial statements, strategic plans and operating metrics for 30+ companies under management 4. Active M&A deals: documentation on 9+ projects, including due diligence and asset valuations 5. Corporate finances: salaries and bonuses for all employees (150+ people), department budgets, financial results 2022-2025 6. Strategic documents: Management Committee materials, top management biographies, corporate strategy, ESG policies 7. Legal documents: counterparty contracts, partner NDAs, regulatory documentation 8. Email correspondence: 500+ email files with deal approvals, negotiations and confidential management communications 9. CEO Office documents: leadership personal files and critical corporate secrets ID 24683
Ransomware	Everbiz Industrial Co. Ltd. id24296 View details	2025-11-29	Taiwan, Province of China	Manufacturing / Engineering	pending
www.everbiz.com.tw https://www.zoominfo.com/c/everbiz-industrial-co-ltd/456233474 Since that time, we have manufactured thousands of assemblies for a wide variety of industrial. Many biggest 1000 companies have come to rely on our unique process to fulfill their requirements. This diverse manufacturing capability has made it possible for us to provide competitive and high quality solutions to virtually any industry. Every product we manufacture is built to our customer exact specifications and the entire process is certified in writing. The company has ISO 9001, ISO 14001, AS9100D, IATF 16949, IPC-A-620 QML and UL certification. We also follow IPC/WHMA-A-620 standard. ID 24296
Ransomware	Devereux Advanced Behavioral Health id24286 View details	2025-11-28	United States	Healthcare / Pharma	pending
www.devereux.org https://www.zoominfo.com/c/the-devereux-foundation/60082215 Devereux Advanced Behavioral Health, headquartered in Villanova, Pennsylvania, is a behavioral healthcare organization that operates a network of clinical, therapeutic, educational, and employment programs. ID 24286
Ransomware	Ecuacorriente S.A. id24189 View details	2025-11-25	Ecuador	Communication / Marketing	pending
https://ecsa.com.ec https://www.emis.com/php/company-profile/EC/Ecuacorriente_SA_en_3950413.html https://www.***.com/business-directory/company-profiles.ecuacorriente_sa.ef08074bdfb377fb12cd904184c089bc.html . Revenue - $1.11 billion USD. Ecuacorriente S.A is a mining company. It is operated by China Railway Construction Copper Crown Investment Co., Ltd. The company is involved in mining and has created over 2,400 direct jobs for the local area, as well as over 10,000 indirect jobs. Ecuacorriente S.A has a mineral processing capacity of 20 million tons per year and operates the Mirador Copper Mine, with an annual production of 354,000 tonnes of copper concentrate and 96,000 tons of copper. The company is also engaged in environmental governance and ecological recovery work. ID 24189
Ransomware	Talarico id24181 View details	2025-11-24	Italy	Manufacturing / Engineering	pending
www.talaricosrl.it https://www.zoominfo.com/c/talarico-srl/533118720 Talarico SRL has 30 years of experience in thermohydraulics and technological systems. The company boasts a well-stocked retail sales counter and has completed large industrial installations. Its extensive showroom features the best brands for home bathroom furnishings, with specialized consultants using state-of-the-art software for design. Talarico SRL also designs and builds various types of industrial hydraulic systems and offers free information and quotes. ID 24181
Ransomware	NBCAPITAL JOINT STOCK COMPANY id24167 View details	2025-11-24	Viet Nam	Finance / Legal / Insurance	pending
https://fiingate.vn/BusinessDirectory/CompanyDetail/859289 NBCAPITAL Investment Co., Ltd. is a Vietnamese company engaged in investment and business operations, maintaining a complete internal corporate structure that includes finance, accounting, legal, human resources, sales, marketing, IT, and operations. Internal documentation shows that the company manages financial reporting, budgeting, taxation, contractual transactions, administrative records, and operational workflows, reflecting a formally organized and fully functioning enterprise. Official notices also confirm active financial account management and ongoing transactional activities. ID 24167
Ransomware	Singapore City Development Company Limited (SINGCONS) id24166 View details	2025-11-24	Singapore	Construction / Real Estate	pending
Singapore City Development Company Limited (SINGCONS) is a construction and real-estate development firm operating in Vietnam and the wider region, offering full-scope services that include land acquisition, master-planning, infrastructure development, construction contracting, and property management. The company focuses on delivering residential, commercial, hospitality and mixed-use projects by leveraging integrated capabilities—from initial feasibility studies and design to construction supervision, interior finishing and post-occupancy management. Headquartered in Singapore with a regional presence, SINGCONS emphasizes quality, sustainability and collaboration with local partners to establish landmark developments in urban centres. https://www.singcons.vn/ www.singcons.com ID 24166
Ransomware	AiHealth id24165 View details	2025-11-24	United States	Healthcare / Pharma	pending
www.aihealth.vn https://pitchbook.com/profiles/company/469493-83#overview https://provider.aihealth.vn/ Provider of online medical services intended to assist in finding personal doctors, booking appointments, and buying medication online. The company's platform allows individuals to find their specialist for healthcare advice, opt for health check-up programs, and receive medicines right at home with the assistance of the online pharmacy network and provides tools for making home healthcare nursing appointments, enabling users to avail themselves of a range of medical services sitting at home. ID 24165
Ransomware	KIM Dental id24164 View details	2025-11-24	Germany	Healthcare / Pharma	pending
https://kimdental.vn/ Kim Dental operates the largest and most reputable dental clinic network in Vietnam, offering nationwide coverage with modern facilities, advanced treatment technologies, and internationally standardized care. With numerous branches across major cities—including Ho Chi Minh City, Hanoi, Dong Nai, Tien Giang, and Vung Tau—the system provides convenient access, high clinical quality, and a comfortable patient experience. Kim Dental continues to expand its presence, maintaining strong expertise, safety standards, and a commitment to making professional oral healthcare affordable and accessible for everyone. ID 24164
Ransomware	Pacific Holdings Group JSC. id24161 View details	2025-11-23	Viet Nam	Healthcare / Pharma	pending
https://vnbis.com/products/companies/pacific-holdings-group-jsc-2675796/ Pacific Holdings Vietnam Joint Stock Company (“Pacific Holdings”) is a diversified healthcare group headquartered in Vietnam, operating a rapidly expanding network of medical and dental clinics across Ho Chi Minh City, Hanoi, and several secondary provinces. The Company manages three primary business lines: Kim Dental, Vietnam’s largest dental clinic chain with 26 locations; Pacific Polyclinic, a multi-specialty outpatient medical center; and Pacific Chiropractic Clinic (PCC), specializing in physiotherapy, chiropractic care, corrective exercise and wellness services. ID 24161
Ransomware	Sansala id24125 View details	2025-11-21	Spain	Communication / Marketing	pending
www.sansala.es https://www.zoominfo.com/c/sansala/466441418 Sansala offers a variety of delicious sandwiches, salads, and desserts made from fresh, natural ingredients. Their products include fresh and frozen options, all certified to the highest food safety and quality standards. The company prides itself on delivering ultra-fresh products, with ingredients sourced directly from the field within 24 hours. Sansala aims to cater to health-conscious consumers looking for tasty and nutritious meal options. ID 24125
Ransomware	Colliers id24123 View details	2025-11-21	Canada	Services	pending
Stock Symbol CIGI Revenue $5.2 Billion colliers.com https://www.zoominfo.com/c/colliers-international-group-inc/12042840 Colliers International Group Inc. provides commercial real estate services to corporations, financial institutions, governments, and individuals worldwide. The companys Sales and Lease Brokerage division offers transaction brokerage services, including landlord representation, tenant representation, and capital markets and investment services, as well as property management, leasing, and valuations. This division provides its services for various asset classes, including office, industrial, retail, multi-family, hotel, and mixed-use properties. Its Outsourcing & Advisory Services division offers portfolio management, transaction and project management, workplace solutions, strategic consulting, property and asset management, and other corporate real estate services, as well as lease administration and facilities management systems; and valuation and appraisal review and management, portfolio or single asset valuation, arbitration and consulting, various studies, tax appeals etc. ID 24123
Ransomware	*.* id23996 View details	2025-11-19	—	Finance / Legal / Insurance	pending
1.5 terabytes of data stolen from one of Asia's largest investment companies, with more than 10 billion USD under management. The stolen data includes: 1. Investment documentation: private placement memorandums, investment memos (Pre-IC/Final-IC), financial models and project budgets 2. Investor database (LP): complete limited partner information, investment terms, contacts, non-disclosure agreements 3. Portfolio companies: financial statements, strategic plans and operating metrics for 30+ companies under management 4. Active M&A deals: documentation on 9+ projects, including due diligence and asset valuations 5. Corporate finances: salaries and bonuses for all employees (150+ people), department budgets, financial results 2022-2025 6. Strategic documents: Management Committee materials, top management biographies, corporate strategy, ESG policies 7. Legal documents: counterparty contracts, partner NDAs, regulatory documentation 8. Email correspondence: 500+ email files with deal approvals, negotiations and confidential management communications 9. CEO Office documents: leadership personal files and critical corporate secrets ID 23996

Thegentlemen

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (2)

Top Activity Sectors (21)

Typical Attacks (17)

Tools Observed (64)

Credential theft

Defense evasion

Discovery

Discovery & enumeration

Exfiltration

LOLBAS (living-off-the-land binaries)

Networking & tunnelling

OffSec

Offensive security tooling

RMM Tools

Remote monitoring & management

Ransom Notes (3)

Victims (1056)

Restricted Access

Now you can see the leak, not just the listing