kairos
Ransomware group profile
65Victims
RussiaSource country
88Impact score
Also Known As
Kairos Extortion Group
Description
Kairos is a financially motivated cyber extortion group that emerged in November 2024, primarily focusing on data theft and extortion rather than traditional ransomware tactics. Their strategy leverages the threat of data exposure to pressure victims into compliance while employing psychological manipulation tactics to maximize ransom payments.
Key insights
- •Kairos employs initial access brokers and exploits vulnerable remote services to gain access to victim networks.
- •The group exfiltrates sensitive data and threatens public disclosure to extract ransom payments from victims.
- •RClone, a legitimate file transfer utility, is a key tool utilized for data staging and exfiltration.
- •Kairos meticulously clears Windows Event Logs to evade detection during their operations.
- •They tailor ransom demands based on the financial capacity of the target and offer discounts for immediate payment.
Threat Level & Status Breakdown
For kairos · Based on incidents in selected period
3threat level
Aggressiveness5/ 10
Lethality0/ 10
Criticality4.1/ 10
Status Breakdown
Claimed67.7%44
First seenJun 2025
Last seenMay 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedJun 22, 2026
Recent activity
Monthly attack count for kairos in the selected period
65Total attacks
9peak in Sep
5.9avg / month
↓ 1 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for kairos
- https://www.realtaxcanada.com/en/home-en/
- http://portail.prelco.ca/
- http://www.rrib.com
- https://www.saglobal.com/en-us/error-404-page.html
- http://45.88.9.60/fuckjewishpeople.arm6
- http://176.65.139.17/main_arm6
- https://hitechpiping.ca/products-by-brand/superklean/
- http://www.compactmould.com/
- https://www.norpak.com/comparing-slider-beds-and-roller-beds-for-conveyor-belts/blog.html
- http://www.sun-rich.com/products/retail/portion-packs
- http://42.227.201.5:34238/i
- https://m9r3p.mint4pack.coupons/hwgbd
- https://www.ayakitchens.com/company/locations/barrie.html
- http://5.59.248.236/bins/kworkerd0
- http://157.245.203.34/ambatukam/rizzx.arm6
- https://www.canstarrestorations.com/covid
- http://telecom.charlesjones.ca/e/
- http://www.metal7.com/en/contact
- https://www.phantomsecurity.ca/
- http://119.185.191.219:46577/i
- https://www.canstarrestorations.com/non
- http://61.52.112.163:45225/i
- http://www.keelewarehousing.com/appt_request.php
- https://kiwinode.kiwi5pack.coupons/batch_id
- http://212.85.24.46:84/iran.armv7l
- http://222.142.245.211:48528/bin.sh
- http://brebeuf.org/api/events/in_range/?from=2018-08-21&to=2018-08-21
- https://www.evergreensd50.com/
- http://42.226.75.86:52139/i
- http://113.218.212.74:81/info.zip
- http://proxyzabc.zabc.net/bins/ethd0
- https://outpost.military423pudd.coupons/5d0t6
- http://www.comark.ca/
- http://www.triple8.ca/?page_id=446
- http://www.kingswoodpark.ca/samsneads/specials
- http://www.hitechpiping.ca/
- http://117.241.55.221:44839/i
- http://www.sea-delight.ca/
- https://kivibros.com/join-our-team/
- http://113.237.54.202:45505/bin.sh
- https://www.compactmould.com/contact-us/
- http://tims.com/faq/
- http://www.supersave.ca
- http://cpcontacts.sierraconstruction.ca
- https://boxstream.pack1kiwi.coupons/sort_data
- http://thecsi.com/index.html
- https://charlesjones.ca/products/
- http://110.36.80.163:51174/i
- https://www.northernontariowires.com
- http://119.179.249.211:51247/bin.sh
- http://115.52.34.18:43480/i
- https://a5v9n.box3pear.coupons/tn27w4lmo
- http://www.hitechpiping.ca/hws/_catalogs/goodyear-chemresischart.pdf
- http://5.59.248.236/bins/kintegrity0
- http://cccm.bc.ca/email_sig/email-click.html
- http://117.209.87.210:60087/bin.sh
- http://www.mcwilliamsmoving.com/lindsay/
- http://157.230.43.57/ambatukam/rizzx.x86_64
- http://123.9.244.125:57505/i
- http://conwest.com/about/
- http://123.13.30.127:40551/i
- http://117.248.26.62:38730/i
- https://www.renmarkfinancial.com/companies/pan-american-silver-corp
- http://115.50.187.108:44497/i
- http://83.60.162.163/info.zip
- http://42.225.229.29:41414/i
- http://157.230.43.57/ambatukam/rizzx.ppc
- http://91.92.243.29/klob
- http://182.120.15.87:35648/bin.sh
- http://112.248.109.127:42347/i
- http://27.37.27.235:53783/i
- http://media.norseman.ca/
- https://sunrise-soya.com/contact
- http://182.116.83.228:52613/bin.sh
- http://115.51.90.36:57316/i
- http://phantomsecurity.ca/contact-us
- https://maxvaluecredits.com/vehicle-loan/
- https://www.centaurproducts.com/
- http://dwgra.com/office-properties/
- http://42.226.75.86:52139/bin.sh
- http://103.251.236.118/b
- http://cpcalendars.sierraconstruction.ca
- http://222.142.245.211:48528/i
- http://www.baisyaakov.ca/
- http://115.50.90.190:50179/i
- http://42.58.45.22:41356/bin.sh
- http://27.102.137.81/main_arm
- http://115.55.4.44:42657/i
- http://dwgra.com/property/crea/11106-fourth-line-halton-hills-ontario/25178590
- http://27.102.137.81/main_ppc
- http://121.73.162.104:8082/sshd
- https://sunrise-soya.com/recipe/west
- http://27.200.13.91:38927/bin.sh
- http://st.ravand.com/speedtest/upload.php
- http://45.88.9.60/fuckjewishpeople.arm7
- http://103.116.52.126/arc
- https://www.cdev.gc.ca/
- http://www.camdon.ca/project_gallery/cardium-well-servicing-drayton-valley
- http://82.26.74.181/iran.armv7l
- http://182.127.126.174:56633/i
- http://182.126.208.145:45313/bin.sh
- http://110.37.0.37:44876/bin.sh
- http://icerivergreenbottleco.com/wp-includes/css/dist/block-library
- http://182.122.172.65:33619/bin.sh
- https://dwgra.com/property/crea/14177-trafalgar-road-halton-hills-ontario/26763662/
- http://84.15.155.121:13201/i
- http://157.245.203.34/ambatukam/rizzx.ppc
- http://27.207.229.127:38342/i
- http://www.confortchem.com/
- https://cpcalendars.sierraconstruction.ca
- http://124.135.134.101:57725/bin.sh
- http://110.36.65.9:49550/i
- http://27.222.77.251:32872/i
- http://180.116.248.47:36359/bin.sh
- https://www.northernontariowires.com/2025costofserviceapplication
- https://crate.mint4pack.coupons/onpgh
- http://www.prelco.ca/architectural/navgeneral/carriere/
- https://technikel.ca/phishing
- http://www.strategicobjectives.com
- http://222.141.74.230:56422/i
- https://hitechpiping.ca/privacy
- https://sunrise-soya.com/recipe/beer
- https://www.pandarose.ca/
- http://148.113.3.160/1.sh
- https://www.renmarkfinancial.com/services
- https://www.eastplats.com/sustainability/environment/
- http://icerivergreenbottleco.com/wp-content/plugins/child-theme-generator/public/js
- http://www.dwllp.ca/
- http://116.140.128.14:54682/i
- http://www.hamptonsecurities.com/
- https://can.mattandsteve.com/
- http://www.alliancemercantile.com/
- http://31.28.107.131:47342/.i
- http://assetlabs.com:1/
- http://controlgmc.com/fds1500/
- http://proxyzabc.zabc.net/bins/kintegrity0
- http://182.127.113.65:50013/i
- http://42.224.125.84:51352/i
- https://www.lasalleinc.com/leadership-team.php
- http://222.140.157.130:59377/bin.sh
- http://116.75.205.46:55993/i
- https://lookheat.nightvision.coupons/sight_ref
- http://123.11.13.12:50879/i
- http://182.119.6.41:36745/i
- http://ravku.com/ambatukam/rizzx.mpsl
- https://workdeck.murta46unprin.coupons/task_file
- http://www.iibg.ca/
- https://www.smtlawyers.ca/our-team
- http://mtl.deschampsimp.com/
- http://ravku.com/ambatukam/rizzx.x86_64
- http://lstlaw.ca/
- http://157.230.43.57/ambatukam/rizzx.arm6
- http://www.duttonbrock.com/team/melissa-mile
- http://157.85.69.255:56777/.i
- https://haes.ca/high-arctic-announces-2023-fourth-quarter-and-year-end-financial-and-operating-results-and-provides-update-on-plan-to-reorganize/
- http://119.179.237.134:36780/i
- http://www.dezinecorp.com/ceramics
- https://uwock.ca/united-ways-funding-into-the-community/
- http://123.4.44.15:48823/bin.sh
- https://www.sabre.ca
- http://27.102.137.81/main_arm5
- http://confortchem.com/~pussy1/verification/leech/update/chase/index.htm
- http://maxvaluecredits.com/scripts/public/****
- https://dezinecorp.com/stanley-classic-trigger-action-mug
- http://www.phoenixlabs.com/
- http://82.26.74.181/iran.armv4l
- http://115.63.17.254:36468/i
- http://42.5.229.233:50685/bin.sh
- http://218.91.138.209:36980/i
- http://103.251.236.118/multi/bins/mips
- https://supersave.ca/roll-off-bin-rentals/
- http://rogitex.com/~pussy1/verification/leech/update/chase
- https://globalpath.ship9fig.coupons/route_map
- http://confortchem.com/~pussy1/verification/leech/update/chase/
- https://www.sabre.ca/
- http://123.8.15.241:47665/i
- http://175.167.95.195:33887/bin.sh
- http://96.44.159.143/201/88sf78f78f38287s7f7d887fg8d8g87g87d8fg8dfg78dfdg7878.hta
- http://144.172.108.230/bins/mynode.armv5l
- https://triella.com/threatlocker
- http://94.236.180.235:53923/i
- https://www.baisyaakov.ca/
- https://www.canstarrestorations.com/appliance
- http://clarkfreightways.com/web/store/default.aspx
- http://124.92.76.184:36571/bin.sh
- https://www.eastplats.com/comments/feed/
- http://182.119.248.106:36245/bin.sh
- https://www.auroraimporting.com/
- https://regulvar.com/360
- http://brebeuf.org/api/events/in_range/?from=2019-08-22&to=2019-08-22
- http://144.172.108.230/penis.sh
- http://119.179.238.241:42309/bin.sh
- http://110.37.87.13:55865/bin.sh
- http://144.172.108.230/bins/mynode.x86_64
- https://www.tims.com
- https://minel-lights.rs/arquivo_20260217222806.txt
- http://110.37.118.66:44479/bin.sh
- https://linkcheck.comparis4sosun.coupons/ref_data
- https://www.ripobec.com/en/
- http://152.89.170.85/bins/kwari.arm
- http://www.bisonfamilymedical.com/location/
- http://182.123.142.179:54382/bin.sh
- https://engines.simson-maxwell.com/
- http://182.121.12.88:42171/bin.sh
- https://www.ayakitchens.com/
- http://www.suratisweetmart.com/
- http://de-25x800.com/multi/bins/arm5
- http://182.116.83.228:52613/i
- https://hitechpiping.ca/about/
- http://mail.tims.com/
- http://www.redknee.com
- http://billetprecision.ca/services/
- https://www.etornetworks.com/
- http://27.222.77.251:32872/bin.sh
- http://www.metal7.com/en/category/rolls-family
- http://proxyzabc.zabc.net/bins/deferwqd
- http://brebeuf.org/api/events/directory_search/
- http://110.36.30.247:60113/i
- https://www.whiskijackresorts.com/
- https://www.hamptonsecurities.com/
- http://1.173.157.244:57204/.i
- https://www.vpn.norseman.ca/
- http://115.55.228.29:49156/i
- http://182.127.115.94:55159/bin.sh
- http://ravku.com/ambatukam/rizzx.arm5
- https://www.camdon.ca/contact-us/
- http://www.sierraconstruction.ca
- https://dundasjafine.com/products/
- http://45.88.9.60/fuckjewishpeople.sh
- https://linkedge.cloudtrace.coupons/edge_node
- http://www.rogerspetro.com/
- https://www.eastplats.com/./investors/presentations/
- http://27.102.137.81/main_mpsl
- http://117.211.33.232:40160/bin.sh
- https://brebeuf.org/alumni/braves-eternal/
- https://sunrise-soya.com/products/sunrise/tofu/
- http://confortchem.com/~pussy1/verification
- https://www.northernontariowires.com/green
- https://starmarketingcanada.com/g-h-cretors/
- http://83.209.248.14:45592/i
- http://brebeuf.org/api/events/in_range/?from=2015-12-31&to=2015-12-31
- http://119.179.237.134:36780/bin.sh
- http://dwllp.ca/
- https://charlesjones.ca/about/
- http://www.carranza.on.ca/resources/accident-benefit-form
- http://175.167.4.51:58849/i
- http://103.251.236.118/multi/bins/arm7
- http://148.113.3.160/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.m68k
- http://42.224.2.230:35518/bin.sh
- http://177.124.61.98:50357/.i
- http://182.116.54.26:48180/bin.sh
- http://temps.regulvar.com:8080/gestinfo
- http://5.59.248.236/bins/mdsync1
- http://ridgid.charlesjones.ca/35318.htm
- http://www.centaurproducts.com
- https://www.cannara.ca/
- http://www.etornetworks.com/
- https://www.concordegroup.ca/newsletter-122025
- http://proxyzabc.zabc.net/bins/kvmirqd
- http://130.12.180.69/armv6l
- http://157.230.43.57/ambatukam/rizzx.arm5
- https://hitechpiping.ca/services/
- https://www.camdon.ca/projects/
- https://www.silverlinegroupinc.com
- http://www.excavationtourigny.ca/
- http://212.85.24.46:84/iran.armv5l
- http://115.59.231.172:33058/bin.sh
- http://130.12.180.69/armv5l
- http://audit.assetlabs.com/streamline?capterra_visitor=capterr
- http://144.172.108.230/bins/mynode.armv4l
- http://www.wheelsauto.com/>
- https://sh1p-rnix.ship5plum.coupons/fmuthxwya
- http://117.209.88.157:54293/i
- http://110.37.104.99:53495/i
- http://58.209.182.219:44109/bin.sh
- http://182.119.248.106:36245/i
- http://148.113.3.160/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm5
- http://www.whiskijackresorts.com/property-item/tyndall-stone-lodge
- http://www.rogitex.com/~pussy1/verification/leech/update/chase/index.htm
- http://duttonbrock.com/uspslabel.zip
- http://87.121.84.92/main_arm5
- http://42.233.140.226:35897/i
- http://www.kingswoodpark.ca/gymnastics/competitive
- https://eastplats.com/careers/
- https://eastplats.com/what
- https://kingswoodpark.ca/golf/proshop/
- http://187.156.206.218/info.zip
- http://42.226.76.152:39588/i
- https://dwllp.ca/mandeep-dhillon/
- http://www.kingswoodpark.ca/gymnastics
- http://www.norpak.com/norpak-partners.html
- http://rogitex.com/~pussy1/verification
- https://concordegroup.ca/e
- http://82.26.74.181/iran.i486
- https://www.idealwelders.com/
- http://boulangerieauger.com/la-difference-auger/
- http://27.194.34.175:38507/i
- https://p3ar-llnk.pear6box.coupons/0v51l
- https://www.simson-maxwell.com/
- https://www.northernontariowires.com/copy-of-green-button-for-customers
- https://www.saglobal.com/cookie
- http://www.utilismartcorp.com/news-events/
- http://kiwi.sun-rich.com
- http://www.camdon.ca/
- https://www.northernontariowires.com/conditions
- http://110.246.225.30:41988/bin.sh
- http://www.mattandsteve.com/ca/
- http://www.utilismartcorp.com/?page_id=47
- http://intranet.regulvar.com/
- http://152.89.170.85/bins/kwari.arm7
- https://cccm.bc.ca/email_s=
- http://110.36.80.170:32963/i
- https://hitechpiping.ca/client
- http://91.92.243.47/v3441.exe
- https://r2k6d.military423pudd.coupons/mj0oj9ac0
- http://110.37.5.60:42891/bin.sh
- http://157.230.43.57/ambatukam/rizzx.mpsl
- https://www.regulvar.com/fr/bulletin-zone-decembre-2024/
- http://www.transportlaberge.com/en/
- https://www.dulay.ca/
- https://haes.ca/careers/
- http://103.251.236.118/multi/bins/mipsel
- http://proxyzabc.zabc.net/bins/kworkerd0
- https://smartraise.probos7raise.coupons/point_ref
- http://157.245.203.34/ambatukam/rizzx.arm7
- https://www.redphoenixconstruction.com/feed/rss2
- http://42.237.8.242:33125/i
- https://magicbook.overdue13wizard.coupons/spell_id
- https://www.canstarrestorations.com/strata
- https://www.impactcanada.com/
- http://www.v4ulogistic.com/
- http://icerivergreenbottleco.com/wp-content/plugins/dwd-map-extended/public/css
- http://www.ripobec.com/fr/service-de-transport
- http://125.43.26.104:39106/i
- https://cloud.conwest.com/
- http://27.37.27.235:53783/bin.sh
- https://wildtimber.timberwalk.coupons/zone_info
- https://hitechpiping.ca/contact/
- https://tacomaengineers.com/profile-partners-jack.html
- https://www.lstlaw.ca/
- http://www.precisionaluminum.ca/
- http://82.26.74.181/iran.sh4
- https://www.northernontariowires.com/ontarioelectricityrebate
- http://117.90.231.139:49394/i
- http://speedtest.ravand.com/speedtest/upload.php
- http://www.kingswoodpark.ca/
- http://42.229.170.238:37915/i
- http://www.rogitex.com/en/~pussy1/verification/leech/update/chase/index.htm
- http://222.141.127.44:43494/bin.sh
- http://82.26.74.181/iran.sparc
- https://acawtrustfunds.ca/health-and-wellness-claim-form
- http://boulangerieauger.com/nouvelles-auger/
- https://sunrise-soya.com/recipe/steamed
- http://46.163.134.250:39756/i
- https://dasmeshschool.com/online/
- https://dwgra.com/property/crea/unit-5b-57-cannifton-road-belleville-ontario/24887136
- https://sunrise-soya.com/recipe/kimchi
- http://www.auroraimporting.com/
- https://sunrise-soya.com/products/sunrise/
- http://de-25x800.com/b
- https://www.whiskijackresorts.com/whiski-jack-app/
- http://kelson.on.ca/contact
- http://www.triella.com/teranet-web/
- http://www.hitechpiping.ca/hws/_catalogs/craneresistoflex-resistopure.pdf
- https://growthstep.probos7raise.coupons/level_up
- http://152.89.170.85/bins/kwari.i686
- https://minel-lights.rs/arquivo_20260217223017.txt
- http://www.schauenburg.com/
- https://www.mcwilliamsmoving.com/
- http://www.obrienavocats.qc.ca/av_dinan.html
- http://www.hamptonsecurities.com/private-clients/
- https://www.groupepiche.ca/systeme-interieur
- http://www.sun-rich.com/
- http://www.kivibros.com/
- https://www.centaurproducts.com/product/ultima-3000/
- https://layerstone.stonecraft.coupons/layer_data
- http://110.37.1.162:53031/i
- https://www.eastplats.com/investors/2025/eastern
- http://110.37.87.13:55865/i
- https://www.norseman.ca/
- http://tapp.tims.com
- http://222.142.253.71:40399/i
- http://189.135.101.5/info.zip
- http://www.rogitex.com/en/~pussy1/verification
- https://xenapp.schauenburg.com
- https://sunrise-soya.com/360
- http://123.11.13.12:50879/bin.sh
- http://148.113.3.160/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.arm6
- https://www.eastplats.com/./investors/media
- http://82.26.74.181/iran.armv6l
- https://hitechpiping.ca/fr/
- https://www.renmarkfinancial.com/companies/neo-performance-materials-inc
- http://www.clarkfreightways.com/web/store/default.aspx
- https://www.cdev.gc.ca/fr/cuge/
- http://www.sun-rich.com/locations/
- http://182.124.171.8:34960/i
- https://essexpowerlines.ca/accounts-services/billing/
- http://61.3.28.239:56953/bin.sh
- http://82.26.74.181/iran.mipsel
- http://123.14.252.27:33775/bin.sh
- https://www.tims.com/fees-training
- http://www.supersave.ca/
- http://212.85.24.46:84/iran.arc
- http://157.245.203.34/ambatukam/rizzx.mips
- https://watersalt.oceansync.coupons/water_stat
- https://www.redphoenixconstruction.com/feed/atom
- http://176.65.149.35/x86
- http://ww38.coglans.com/
- http://www.constructiondprovost.com/upload/contenu-fichiers/kingskrupellos.txt
- http://14.168.37.165:13069/.i
- http://support.bridgecast.ca/
- https://portal.nowinc.ca
- https://strategicobjectives.com/2025/02/22/canadas-leading-financial-institutions-collaborate-with-victim-services-toronto-to-support-human-trafficking-survivors/
- http://titantrailers.com/thinwall/
- http://www.csem.qc.ca/notre-reseau.html
- http://billetprecision.ca/?galleries=showcas
- http://5.59.248.236/bins/kswapd1
- https://www.navitaspet.com/
- http://www.tacomaengineers.com/
- http://www.rogitex.com/en/rubbers/68-emulsion-styrene-butadiene-rubber
- https://portentry.fig2ship.coupons/dock_data
- https://www.cote-expert-equipements.com/pdf/cote-catalogue-produits-2021-web-fr.pdf
- http://www.sierraconstruction.ca/
- http://www.triple8.ca/?page_id=444
- http://182.127.111.215:33500/bin.sh
- https://deepcoast.bluewave.coupons/tide_data
- http://148.113.3.160/001010101010010110101011101010101101010111010101/nwfaiehg4ewijfgriehgirehaughrarg.i686
- http://mailto:[email protected]/
- https://hitechpiping.ca/comments/feed/
- https://regulvar.com/wp-content/uploads/2022/11/360
- http://222.134.173.145:35312/bin.sh
- https://sensiblesolutions.ca/about/
- https://www.northernontariowires.com/customerchoiceapplicationform
- https://guscmg.guscanada.ca/
- http://60.19.33.106:60411/i
- http://115.51.90.36:57316/bin.sh
- http://170.254.10.212:44467/bin.sh
- http://219.155.28.148:37281/bin.sh
- http://www.rogitex.com/en/~pussy1/verification/leech/update/chase
- http://182.126.208.145:45313/i
- https://www.dwgra.com
- http://www.alliancemercantile.com
- http://www.triple8.ca/?page_id=395
- http://www.tacomaengineers.com/profile-partners-jack.html
- https://www.renmarkfinancial.com/vndrs
- http://64.176.37.51:8089/shellcode.bin
- https://www.ahmadiyya.ca/member/calendar/jalsa-salana-qadian
- http://www.kelson.on.ca/
- http://www.essexpowerlines.ca/downloads/cdm_docs/hap/hap-procurement/hap-eligible-participant-experience.pd
- http://omegatoolcorp.com/capabilities/engineering/
- https://myaccount.essexpowerlines.ca/app/capricorn
- https://checknode.censure47contr.coupons/state_val
- http://www.ggw.net/
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for kairos
CVE-2026-41940
CVE-2026-3854
CVE-2026-31431
Other
T1486
T1486
T1490
T1490
T1070.001
T1070.001
T1562.001
T1562.001
T1078
T1078
T1047
T1047
T1021.001
T1021.001
T1059
T1059
T1583
T1583
T1550
T1550
T1040
T1040
T1027
T1027
Victims(65)
| Company | Domain | Country | Industry | Status | Discovered | |
|---|---|---|---|---|---|---|
| Commune De Camiers | camiers.fr | FR France | Government & Defense | Unknown | 24 days ago | |
| McCarthy Inc | mccarthyinc.com | US United States | Other | Unknown | about 1 month ago | |
| Arwini | arwini.de | DE Germany | Healthcare | Unknown | about 1 month ago | |
| Ayuntamiento de Valdemoro | valdemoro.es | ES Spain | Government & Defense | Unknown | about 1 month ago | |
| Houk Air Conditioning | houkac.com | US United States | Professional Services | Unknown | about 2 months ago | |
| Gregory Jewellers | — | AU Australia | Retail & E-Commerce | Claimed | 2 months ago | |
| Nordenta (a daughter company of LIFCO) | — | DK Denmark | Healthcare | Claimed | 2 months ago | |
| Strata Republic | — | AU Australia | Professional Services | Claimed | 2 months ago | |
| FriendlyCare Pharmacy | — | AU Australia | Healthcare | Claimed | 2 months ago | |
| Pullen Moving | — | US United States | Transportation | Claimed | 2 months ago | |
| Colonial Presbyterian Church | — | US United States | Retail & E-Commerce | Claimed | 2 months ago | |
| South Florida Injury Centers | — | US United States | Healthcare | Claimed | 2 months ago | |
| Resch Maschinenbau | resch-maschinenbau.de | DE Germany | Manufacturing | Unknown | 3 months ago | |
| Folet & Rivoire | frc-avocats.fr | FR France | Professional Services | Unknown | 3 months ago | |
| Institute of Social Security - Paraguay | ips.gov.py | PY Paraguay | Government & Defense | Unknown | 3 months ago | |
| Katz Kantor Stonestreet & Buckner | katzkantor.com | US United States | Professional Services | Unknown | 4 months ago | |
| Rockwood Retirement Communities | rockwoodretirement.org | US United States | Retail & E-Commerce | Unknown | 4 months ago | |
| The Marena Group | marena.com | US United States | Healthcare | Unknown | 4 months ago | |
| Seagrass Boutique Hospitality Group | seagrassbhg.com | AU Australia | Hospitality | Unknown | 4 months ago | |
| Robbins Parking Service Ltd | robbinsparking.com | CA Canada | Transportation | Unknown | 4 months ago |
Page 1 of 4
Affected countries(24)
Countries where this group has been reported to target or leak victims.