THREAT ACTOR
CICADA3301_
DormantCICADA3301 is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CICADA3301, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 30
- 2024 48
Leak site mirrors
16 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
cicadabv7vicyvgz5khl7v2x5yygcgow7ryy6yppwmxii4eoobdaztqd.onionCicada3301 snapshot · 2025-11-12 11:15 -
cicadacnft7gcgnveb7wjm6pjpjcjcsugogmlrat7u7pcel3iwb7bhyd.onionCicada3301 snapshot · 2025-05-09 03:14 -
cicadaxousmk6nbntd3ucxefmfgt2drhtfdvh7gmdeh3ttvudam6f2ad.onionCicada3301 snapshot · 2025-01-03 21:06 -
cicadafhqpjwm2sblkfbuwn7sglbibuejr3m7fildpqpjv3hghlhb4id.onionCicada3301 snapshot · 2025-11-12 09:11 -
zf6bl4dczp5z7uaba2lhm5wrhrpflwvzsx2nhf7zyf63tpsfzc54tbad.onionCicada3301 snapshot · 2025-05-09 03:27 -
hgannromwuui7n2jvphpteposc3gioqkuo2ncb6fzopasgcq7ixcjeqd.onionCicada3301 snapshot · 2025-05-09 03:22 -
osd6tsgegts2xaqo3o2hrpqatwlslqfyc3msvyksad4iucauif3oqqad.onionCicada3301 snapshot · 2025-05-09 03:29 -
uds75egfqi7mfpxckf2un742qsj6rh3kfrydqaldwgkrqp2a37lk6fyd.onionCicada3301 snapshot · 2025-05-09 03:32 -
wuyfbttjjzsmr5ghl5hoi75ytse3bwrqgk63c6guv3lhw7hwtxbgveid.onionCicada3301 snapshot · 2025-05-09 03:17 -
bmfyfxl74qb6rsukgwymv7e22ua4uvhszsamqwx7jmj57qkamxwlhbid.onionCicada3301 snapshot · 2025-05-09 03:03 -
yaoehn32c2s5pwsuzhaa4lsu2a4seycpwyvn5gfz3bn4i74t2jo3frad.onionCicada3301 snapshot · 2025-05-09 03:05 -
5atqn4dwosjauijzj445mm7t6bqrcvzlzcylpmpnx243jxvlimyb6aid.onionCicada3301 snapshot · 2025-05-09 03:23 -
ruzislhpcuvfzw3t2xfqu7gog3gs5j2u65ysaq3ybqkzri3hjddaqgad.onionCicada3301 snapshot · 2025-11-12 10:10 -
leakshrlgof456tiw4ww5moiqlnrcork7q7r3cjgmsvex6zazpluhlad.onionsnapshot · 2025-07-09 23:05 -
cicadapkh4vg2qh4qcoelszhftota5cdcgrwbjcesdyiwjwmsfzgobid.onionsnapshot · 2025-11-12 09:05 -
sia5sekp5vokknfigbnef53mrb677lm2vy42wgnespkr5af4z4y4stad.onionIndex of / snapshot · 2025-10-03 06:11
Recent victims
The 50 most recent victims claimed by CICADA3301. Total in the index: 78.
| Date listed | Victim | Description |
|---|---|---|
| 2025-09-04 | CI Engineering | 9 |
| 2025-07-18 | diasdeprimavera.com.br | 28 |
| 2025-07-18 | gatlogistica.com.br | 22 |
| 2025-07-18 | B&M - Expertise - Audit | 23 |
| 2025-07-18 | Burnham Nationwide | 20 |
| 2025-07-18 | Sensical | 20 |
| 2025-07-14 | Сonasa | 35 |
| 2025-07-10 | PACIFIC BIOLABS | 3 |
| 2025-07-09 | Mack Energy Corp | 28 |
| 2025-04-22 | Asesoría Bieito | 6 |
| 2025-04-22 | Natilait | 6 |
| 2025-04-22 | Amazon Transportes | 9 |
| 2025-04-09 | Správa služeb hlavního města Prahy | 12 |
| 2025-04-05 | Eagle Distilleries | 3 |
| 2025-03-25 | I.A.T.S.E. Local 667/669 | 25 |
| 2025-03-22 | MinebeaMitsumi Inc | 21 |
| 2025-02-25 | Benjamin Consulting Services | 10 |
| 2025-02-25 | Executive Agenda | 17 |
| 2025-02-25 | Birdsall Muller LLC | 15 |
| 2025-02-24 | Johnson's Nursery | 8 |
| 2025-02-23 | Goldstein Law Group, S.C. | 25 |
| 2025-02-23 | Northern Management | 27 |
| 2025-02-23 | The Northwestern Illinois Association | 26 |
| 2025-02-23 | Digital Technology Co., Ltd. | 1 |
| 2025-02-09 | Substitute Teacher Service | 13 |
| 2025-02-04 | SSMC | 17 |
| 2025-02-04 | Rivers Casino and Rush Street Gaming | 13 |
| 2025-02-04 | Asterra Properties | 10 |
| 2025-02-04 | Caliente Construction | 14 |
| 2025-01-03 | ISOR | 19 |
| 2024-12-20 | Frameworks | 18 |
| 2024-12-16 | Concession Peugeot | 24 |
| 2024-12-08 | D&K Group, Inc. | 78104 |
| 2024-12-08 | Voss Belting & Specialty | 78832 |
| 2024-12-08 | CK Technology Group | 34 |
| 2024-10-25 | Centrillion Technologies | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-19 | T-Space | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-18 | INDIBA Group | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-18 | Dubin Group | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-18 | RDC Control Ltd | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-18 | Racing Forensics Inc | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-18 | Luxwood Software Tools | !!! IF THE COMPANY DOES NOT CONTACT US SOON, THE DATA WILL BE PUBLISHE… |
| 2024-10-04 | Conductive Containers, Inc | The data will be released soon if the company doesn't contact us. We … |
| 2024-09-24 | Bogdan Frasco, LLP | We offer a wide range of tax and accounting services focusing on small… |
| 2024-09-24 | John W. Brooker Co., CPAs | Financial success is best achieved when the financial advisors know yo… |
| 2024-09-24 | Hughes Gill Cochrane Tinetti | Headquartered in Walnut Creek, HGCT is a California law firm, with Bay… |
| 2024-09-24 | Crown Mortgage Company | Crown Mortgage Company, located in Oak Lawn, IL, is a local Chicago mo… |
| 2024-09-24 | Model Engineering | Founded in 1972, Model is a dynamic group of Architects and Engineers … |
| 2024-09-21 | Bayou DeSiard Country Club | Downloads: http://cicadacnft7gcgnveb7wjm6pjpjcjcsugogmlrat7u7pcel3iwb7… |
| 2024-09-20 | Capital Printing | If the company does not contact us by 09.22.24 18:00 UTC, the data wil… |
CONFIRMED ATTACKS
Cicada3301 confirmed attacks: 15 verified incidents
Ransomnews has verified 15 Cicada3301 incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2024 to August 2025. United States accounts for 9 of them (60%), with victims recorded in 5 countries in total. The most affected sector is manufacturing, at 3 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 14. Where a figure was disclosed (9 cases), these incidents account for 143,994 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Cicada3301 incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2025 | C&I Engineering | Service | Kentucky, United States | — | Unknown | Source |
| July 2025 | Mack Energy Corporation | Other | New Mexico, United States | 413 | Unknown | Source |
| April 2025 | Správa služeb hlavního města Prahy (Prague City Service Administration) | Government | Prague, Czechia | — | Unknown | Source |
| March 2025 | MinebeaMitsumi Inc. | Manufacturing | Tokyo, Japan | — | Unknown | Source |
| February 2025 | Digital Technologies Corporation | Technology | Tokyo, Japan | 6,400 | Unknown | Source |
| December 2024 | Substitute Teacher Service, Inc. | Education | Pennsylvania, United States | 45,886 | Unknown | Source |
| October 2024 | Rivers Casino Philadelphia | Other | Pennsylvania, United States | 18,825 | Unknown | Source |
| September 2024 | Kashima Coat (Miyaki Corporation) | Manufacturing | Hamamatsu, Japan | — | Unknown | Source |
| August 2024 | Riley Pope & Laney, LLC | Legal | South Carolina, United States | 7,699 | Unknown | Source |
| August 2024 | UFCW Local 135 | Service | California, United States | 62,692 | Unknown | Source |
| August 2024 | Chama Gaúcha Brazilian Steakhouse | Food and Beverage | Texas, United States | 387 | Unknown | Source |
| August 2024 | VVS-Eksperten | Retail | Hedensted, Denmark | — | Unknown | Source |
| July 2024 | NARSTCO | Manufacturing | Texas, United States | 566 | Unknown | Source |
| June 2024 | ASST Rhodense | Healthcare | Milan, Italy | — | No | Source |
| April 2024 | Basement Systems, Inc. | Construction | Connecticut, United States | 1,126 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Cicada3301's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.