THREAT ACTOR
AUDIT-TEAM_
ActiveAUDIT-TEAM is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of AUDIT-TEAM, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 43
Leak site mirrors
2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/// DATA EXPOSURE TERMINAL /// snapshot · 2026-09-23 03:00 -
cjg2avmzoly7k6mw7xobnyre354jxro4qegkoazhsmigdk2j3aziexyd.onion[ SYSTEM ERROR ] snapshot · 2026-09-23 02:16
Recent victims
The 50 most recent victims claimed by AUDIT-TEAM. Total in the index: 43.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-22 | AUDIT ENTITY: vit.ac.in | AUDIT ID: 5DC9129A6EA7F384 / DISCOVERY DATE: 2026-09-13 |
| 2026-09-22 | AUDIT ENTITY: Pr***IT | AUDIT ID: 746464CD386A9234 / DISCOVERY DATE: 2026-09-22 |
| 2026-09-20 | AUDIT ENTITY: TEK SPB | AUDIT ID: 993E2D59C377AFDE / DISCOVERY DATE: 2026-09-12 |
| 2026-09-20 | AUDIT ENTITY: st***co | AUDIT ID: 661EB89AEF2A1E8D / DISCOVERY DATE: 2026-09-20 |
| 2026-09-19 | AUDIT ENTITY: td***up | AUDIT ID: AB8A1616FC11F818 / DISCOVERY DATE: 2026-09-19 |
| 2026-09-18 | AUDIT ENTITY: kit-e.jp | AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09 |
| 2026-09-16 | AUDIT ENTITY: palletshop | AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08 |
| 2026-09-16 | AUDIT ENTITY: Wise IT | AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08 |
| 2026-09-16 | AUDIT ENTITY: buben | AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08 |
| 2026-09-16 | AUDIT ENTITY: dg.ac.kr | AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08 |
| 2026-09-16 | AUDIT ENTITY: gownet.net | AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08 |
| 2026-09-16 | AUDIT ENTITY: krimax.org | AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08 |
| 2026-09-14 | AUDIT ENTITY: Ne***ox | AUDIT ID: 42FFBFBFF9241F2E / DISCOVERY DATE: 2026-09-14 |
| 2026-09-13 | AUDIT ENTITY: vi***in | AUDIT ID: 5DC9129A6EA7F384 / DISCOVERY DATE: 2026-09-13 |
| 2026-09-12 | AUDIT ENTITY: TE***PB | AUDIT ID: 993E2D59C377AFDE / DISCOVERY DATE: 2026-09-12 |
| 2026-09-10 | AUDIT ENTITY: ki***jp | AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09 |
| 2026-09-10 | AUDIT ENTITY: my***ru | AUDIT ID: D91BED92A5A9223F / DISCOVERY DATE: 2026-09-09 |
| 2026-09-10 | AUDIT ENTITY: mo***al | AUDIT ID: 2431ED9F65ADD5B1 / DISCOVERY DATE: 2026-09-10 |
| 2026-09-09 | AUDIT ENTITY: dg***kr | AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08 |
| 2026-09-09 | AUDIT ENTITY: go***et | AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08 |
| 2026-09-09 | AUDIT ENTITY: kr***rg | AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08 |
| 2026-09-08 | AUDIT ENTITY: bu***en | AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08 |
| 2026-09-08 | AUDIT ENTITY: Wi***IT | AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08 |
| 2026-09-08 | AUDIT ENTITY: pa***op | AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08 |
| 2026-09-04 | AUDIT ENTITY: mansurovogroup | AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26 |
| 2026-09-04 | AUDIT ENTITY: PIT.local | AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27 |
| 2026-08-27 | AUDIT ENTITY: PI***al | AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27 |
| 2026-08-26 | AUDIT ENTITY: Demidov Steel Group | AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 |
| 2026-08-26 | AUDIT ENTITY: ma***up | AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26 |
| 2026-08-18 | AUDIT ENTITY: De***up | AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 |
| 2026-06-25 | AUDIT ENTITY: I-SYS | AUDIT ID: C66B828414389C27 / DISCOVERY DATE: 2026-06-15 |
| 2026-06-15 | AUDIT ENTITY: I-***YS | AUDIT ID: C66B828414389C27 / DISCOVERY DATE: 2026-06-15 |
| 2026-06-02 | AUDIT ENTITY: ca***lm | AUDIT ID: 168B1F8DD83F7DD9 / DISCOVERY DATE: 2026-06-02 |
| 2026-05-28 | AUDIT ENTITY: On***de | AUDIT ID: DF2287D8C495C426 / DISCOVERY DATE: 2026-05-28 |
| 2026-05-23 | AUDIT ENTITY: Mopas Online Supermarket | AUDIT ID: CC92E841B75A3DF6 / DISCOVERY DATE: 2026-05-15 |
| 2026-05-18 | AUDIT ENTITY: Trésor Public | AUDIT ID: D6A9F21B7E4C3A59 / DISCOVERY DATE: 2026-05-10 |
| 2026-05-15 | AUDIT ENTITY: Mo***et | AUDIT ID: CC92E841B75A3DF6 / DISCOVERY DATE: 2026-05-15 |
| 2026-05-10 | AUDIT ENTITY: Tr***ic | AUDIT ID: D6A9F21B7E4C3A59 / DISCOVERY DATE: 2026-05-10 |
| 2026-04-07 | AUDIT ENTITY: [ COOPERATION REACHED ] China | // ALL ACQUIRED DATA HAS BEEN PURGED FROM OUR SERVERS // ENTERPRISE S… |
| 2026-04-07 | AUDIT ENTITY: [ COOPERATION REACHED ] Thailand | // ALL ACQUIRED DATA HAS BEEN PURGED FROM OUR SERVERS // ENTERPRISE S… |
| 2026-04-07 | AUDIT ENTITY: [ COOPERATION REACHED ] Hong Kong | // ALL ACQUIRED DATA HAS BEEN PURGED FROM OUR SERVERS // ENTERPRISE S… |
| 2026-04-07 | AUDIT ENTITY: joycity | Joycity is a prominent South Korean game developer and publisher found… |
| 2026-04-07 | AUDIT ENTITY: Kawasaki Motors Philippines Corporation | Kawasaki Motors Philippines Corporation (KMPC), located in Muntinlupa,… |
CONFIRMED ATTACKS
Audit Team confirmed attacks: 3 verified incidents
Ransomnews has verified 3 Audit Team incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2026 to May 2026. Senegal accounts for 1 of them (33%), with victims recorded in 3 countries in total. The most affected sector is food and beverage, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Audit Team incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| May 2026 | Mopaş Online Supermarket | Food and Beverage | Istanbul, Turkey | — | Unknown | Source |
| May 2026 | Direction Générale de la Comptabilité Publique et du Trésor (DGCPT) | Government | Dakar, Senegal | — | Unknown | Source |
| March 2026 | JOYCITY | Technology | Seongnam-si, South Korea | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Audit Team's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.