THREAT ACTOR
CYCLOPS_
DormantCYCLOPS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CYCLOPS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2023 7
Leak site mirrors
2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
nt3rrzq5hcyznvdkpslvqbbc2jqecqrinhi5jtwoae2x7psqtcb6dcad.onionBlog | Knight snapshot · 2023-10-13 16:13 -
wy35mxvqxff4vufq64v4rrahxltn6ry33hjoogydwti6wbqutjaxrvid.onionsnapshot · 2024-12-09 20:31
Recent victims
The 50 most recent victims claimed by CYCLOPS. Total in the index: 7.
| Date listed | Victim | Description |
|---|---|---|
| 2023-07-26 | important information（Knight） | We are about to close the old panel and blog and in version 2. 0 we re… |
| 2023-07-23 | Pechexport | Infrastructure and logistics Pêchexport is located in Majunga on a sur… |
| 2023-07-23 | Cvlan | Cvlan( Srl is a company that operates in the Information Technology an… |
| 2023-07-14 | Superloop ISP | Superloop is Australia’s modern challenger telco and internet service … |
| 2023-07-01 | Guatemala Military Intelligence Directorate | The Guatemalan Armed Forces (Fuerzas Armadas de Guatemala) consists of… |
| 2023-07-01 | ALTARGRUP | Within the roof of Altar Group, the foundations of which were laid in … |
| 2023-07-01 | Atherfield Medical Service | Hospitals & Physicians Clinics · Australia Atherfield Medical Service… |
CONFIRMED ATTACKS
Cyclops confirmed attacks: 1 verified incident
Ransomnews has verified 1 Cyclops incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in July 2023. Australia accounts for 1 of them (100%). The most affected sector is healthcare, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Cyclops incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2023 | Atherfield Medical & Skin Cancer Clinic | Healthcare | Yass, Australia | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Cyclops's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.