THREAT ACTOR
BLACKSHRANTAC_
DormantBLACKSHRANTAC is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of BLACKSHRANTAC, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 3
- 2025 39
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
b2ykcy2gcug4gnccm6hnrb5xapnresmyjjqgvhafaypppwgo4feixwyd.onionBlackShrantac snapshot · 2026-04-27 07:05 -
jvkpexgkuaw5toiph7fbgucycvnafaqmfvakymfh5pdxepvahw3xryqd.onionBlack Shrantac snapshot · 2026-01-15 03:08 -
shrantacpxim7z6m6pnszi52bb2tp23sntby3hklt36rezdja7bdjsyd.onionBlackShrantac snapshot · 2026-04-27 06:24
Recent victims
The 50 most recent victims claimed by BLACKSHRANTAC. Total in the index: 42.
| Date listed | Victim | Description |
|---|---|---|
| 2026-01-22 | PKT QS | |
| 2026-01-08 | National Water Authority | |
| 2026-01-08 | SCHNEIDER PROTOTYPING INDIA PVT. LTD | |
| 2025-12-23 | Agrícola Cerro Prieto | |
| 2025-12-19 | Netstar Australia PTY Ltd | |
| 2025-12-15 | demilac, Inc | |
| 2025-12-14 | VFM Systems & Services (P) Ltd | |
| 2025-11-29 | Rasen Insaat Ve Yatirim Ticaret A.S. | |
| 2025-11-29 | Badan Pengelola Keuangan Haji | |
| 2025-11-21 | Superintendencia Nacional de Fiscalización Laboral | |
| 2025-11-13 | M&BM, Inc | |
| 2025-11-13 | libertyshoes, Inc | |
| 2025-11-13 | Newgen Digitalwork | |
| 2025-11-13 | simsekas, Inc | |
| 2025-11-13 | MultistateTax Inc | |
| 2025-11-13 | Carvimsa | |
| 2025-10-31 | CCI Tax Pros, Inc | |
| 2025-10-31 | TENAX Law Group PC | |
| 2025-10-31 | The Matlusky Firm LLC | |
| 2025-10-31 | CyPark Resources Berhad | |
| 2025-10-31 | Eligibility Tracking Calculators | |
| 2025-10-30 | ApleNet Co., Ltd | |
| 2025-10-20 | Computer World W.L.L | |
| 2025-10-20 | Al Ahly Leasing & Factoring Company | |
| 2025-10-20 | Cabinets 2000, LLC | |
| 2025-10-17 | SK shieldus | |
| 2025-10-16 | Altas Temizlik | |
| 2025-10-16 | Gulf Warranties LLC | |
| 2025-10-10 | Falco Electronics | |
| 2025-10-04 | Standard Fiber | |
| 2025-10-02 | S*** F***.com | |
| 2025-09-29 | General Directorate of Taxes and Estates | |
| 2025-09-26 | Sta***** Fib**.com | |
| 2025-09-26 | Ak** Me*** | |
| 2025-09-20 | Altaş | |
| 2025-09-20 | Klinglnberg india pvt ltd | |
| 2025-09-18 | klingLnberg.in | |
| 2025-09-18 | altas.com.tr | |
| 2025-09-17 | kli******erg.in | |
| 2025-09-17 | alt******.tr | |
| 2025-09-16 | kli******erg.com | |
| 2025-09-16 | alt**********.com |
CONFIRMED ATTACKS
Blackshrantac confirmed attacks: 8 verified incidents
Ransomnews has verified 8 Blackshrantac incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2025 to March 2026. Peru accounts for 2 of them (25%), with victims recorded in 7 countries in total. The most affected sector is government, at 3 confirmed victims. Where a figure was disclosed (1 case), these incidents account for 170,000 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Blackshrantac incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2026 | Alphington Sports Medicine | Healthcare | Northcote, Australia | — | Unknown | Source |
| January 2026 | F-One Co., Ltd. | Manufacturing | Osaka, Japan | 170,000 | Unknown | Source |
| December 2025 | Autoridad Nacional del Agua | Government | Lima, Peru | — | Unknown | Source |
| December 2025 | Dem İlaç Sanayi ve Ticaret A.Ş | Healthcare | Istanbul, Turkey | — | Unknown | Source |
| November 2025 | Superintendencia Nacional de Fiscalización Laboral (Sunafil) | Government | Lima, Peru | — | Unknown | Source |
| October 2025 | Cabinets 2000, LLC | Manufacturing | California, United States | — | Unknown | Source |
| October 2025 | SK Shieldus | Service | Seongnam-si, South Korea | — | Unknown | Source |
| September 2025 | Direction Générale des Impôts et des Domaines (DGID) | Government | Plateau, Senegal | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Blackshrantac's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.