THREAT ACTOR
BLACKOUT_
ActiveBLACKOUT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BLACKOUT, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 2
- 2025 2
- 2024 9
Leak site mirrors
9 mirrors tracked, 5 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onionsnapshot · 2026-09-23 00:17 -
4qyjonpyksc52bc3fsgfgedssqgo4a6vlfsjknqnkncbyl4layqkqjid.onionIndex of / snapshot · 2026-09-23 02:17 -
ao5oo2luy6avdfomyw7hcegmfl4let2g5bzjqjzch6b5rpdshmuvccad.onionIndex of / snapshot · 2026-09-23 01:03 -
urey23jtg6z7xx3tiybmc4sgcim7dawiz2abl6crpup2lfobf7yb5wyd.onionIndex of / snapshot · 2026-09-22 22:06 -
mu6se7h7qfwuqclr4cc6zy7qevod6gyk37aq5vwnayrtbx3qqycx2fyd.onionIndex of / snapshot · 2026-09-23 01:12 -
eleav2eq3ioyiuevbyvqaz3vruwvpislphszo4cm7n56itbpnupxngyd.onionIndex of / snapshot · 2026-09-23 01:11 -
2cyxmof76rxeqze5snxxooqmhzjtcploqswxoxmenfayphumdhrtrzqd.onionIndex of / snapshot · 2026-09-23 02:02 -
rqqn25k3hgmfkh7ykjbmakjgidwweomr7cbpy6pfecpxs57r5iwzwtyd.onionIndex of / snapshot · 2026-09-23 02:19 -
idep6vd7ywl7uruhsutqjdnjawe33hct35523rrmf73kb46xrhfb5sid.onionIndex of / snapshot · 2026-09-23 00:29
Recent victims
The 50 most recent victims claimed by BLACKOUT. Total in the index: 13.
| Date listed | Victim | Description |
|---|---|---|
| 2026-07-18 | bluebellgroup.com | Bluebell Group is a Hong Kong-based, family-owned omnichannel brand cu… |
| 2026-02-26 | en.yofc.com | Yangtze Optical Fibre and Cable (YOFC) is a leading global supplier of… |
| 2025-07-09 | www.miatech.net | Miatech is a US-based company that provides passenger travel services … |
| 2025-03-20 | yano.tokyo | Yano Electronics Ltd. is a company in the field of microelectronics, w… |
| 2024-12-09 | nedamaritime.gr | Neda Maritime is an independent shipping company that manages and oper… |
| 2024-09-29 | cdc-biodiversite.fr | CDC Biodiversité is a French environmental protection company making t… |
| 2024-08-22 | antaeustravel.com | Antaeus Travel is a travel agency specializing in corporate and sea tr… |
| 2024-07-14 | luzan5.com | luzan5.com is a small company in the healthcare consulting field, perh… |
| 2024-07-03 | badel1862.hr | Badel 1862 is an alcoholic beverage manufacturer from Croatia and at t… |
| 2024-05-29 | mcmtelecom.com | We carried out an attack on mcmtelecom.com, a b2b telecommunications p… |
| 2024-04-18 | ht-hospitaltechnik.de | Why don't medical companies pay us? As usual we got into the network h… |
| 2024-02-27 | ch-armentieres.fr | First post on our new blog ! We encrypted 100+ servers and workstation… |
| 2024-02-27 | metal7.com | This time we dug into the network of metal7.com, a company that manufa… |
CONFIRMED ATTACKS
Blackout confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Blackout incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2024 to September 2024. France accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is service, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Blackout incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2024 | CDC Biodiversit | Service | Paris, France | — | Unknown | Source |
| April 2024 | Hospitaltechnik Planungsgesellschaft mbH | Healthcare | Krefeld, Germany | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Blackout's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.