Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

COOMING · Threat actor profile

// THREAT ACTOR

COOMING_

Dormant

COOMING is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of COOMING — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

38 Victims tracked
0 / 2 Active mirrors
2022-01-25 First listing
2022-02-04 Most recent

Victims by year

  • 2022 38

Leak site mirrors

2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • z6mikrtphid5fmn52nbcbg25tj57sowlm3oc25g563yvsfmygkcxqbyd.onion CoomingProject announcement snapshot · 2022-02-05 01:18
  • teo7aj5mfgzxyeme.onion

Recent victims

The 50 most recent victims claimed by COOMING. Total in the index: 38.

Date listed Victim Description
2022-02-04 WinningLife International Limited
2022-01-25 Canadian Warmblood Horse Breeders Association - Home
2022-01-25 Catalogue des cours de Télécom SudParis
2022-01-25 Fountain
2022-01-25 Annonces et Vous Particuliers
2022-01-25 Bellissima Fashions
2022-01-25 Journality
2022-01-25 MangaDex - MangaDex
2022-01-25 Dohuk
2022-01-25 Miningbase
2022-01-25 Afohs Club – Enjoy The Pride
2022-01-25 C-PatEx - Cryptocurrency Exchange
2022-01-25 hacker.org - The Hacker Community Online
2022-01-25 Wibernet
2022-01-25 Municipal Government of Calamba, Philippines
2022-01-25 Beat The System With Beatchain
2022-01-25 EAP Films and Theatres Private Limited - Home
2022-01-25 Global Crypto Exchange
2022-01-25 UUOOI
2022-01-25 Politeknik Elektronika Negeri Surabaya | Emerging Technology
2022-01-25 Pré-Sal Petróleo S.A. PPSA - Bem-Vindo!
2022-01-25 AUTO.RIA™ — Автобазар №1. Купить и продать авто легкÐ
2022-01-25 Freewallet | Multi-currency Online Crypto Wallet for BTC, ETH
2022-01-25 Synthetic Roofing Products and Information - InterWrap
2022-01-25 Zurich Insurance Group | Zurich Insurance
2022-01-25 ANTEL - Télécommunications nationales uruguayennes
2022-01-25 CFE
2022-01-25 City College - Home
2022-01-25 Curriculum Information Turkey
2022-01-25 Stream Live Video Online | Vimeo Livestream
2022-01-25 SEAT Coches, ofertas y noticias - Configurador y prueba
2022-01-25 Aeropuerto Internacional de la Ciudad de México
2022-01-25 MegaCine TV
2022-01-25 EMPLOYEES FROM ORANGE TELECOM
2022-01-25 kućni internet | wifi internet | wi - Zona.ba
2022-01-25 Renault India
2022-01-25 Amigo-Kids.com: Mayoral детски дрехи и обувки
2022-01-25 Kohinoor International School

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.