Close Menu

DARKMATTER · Threat actor profile

// THREAT ACTOR

DARKMATTER_

Active

DARKMATTER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of DARKMATTER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

0 Victims tracked
17 / 17 Active mirrors
— First listing
— Most recent

Leak site mirrors

17 mirrors tracked, 17 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • s42fv44x5r2ubrrydl5edh4srwch7sr3j7goy34sfuaqhcqbfwhuqyad.onion DarkMatter News snapshot · 2026-08-06 21:00
  • rda6wisv3wkznfz5uimkbr5bmqdeynocjxnk67li4x4sud35hcclgwid.onion DarkMatter News snapshot · 2026-08-06 21:10
  • 2el6bpoz2ely34iqcmxsiicpdmzp37jjtsggxwukbk5jx6x6bdxbh3ad.onion DarkMatter News snapshot · 2026-08-06 21:32
  • ydq4dhq6kel2bcfdvukjodffob6a6qswemadm36mt3e4wb2rlespxdyd.onion DarkMatter News snapshot · 2026-08-06 21:26
  • 7o7himec23q5yl4qkzaqkadj3oqtp5rd6rjcrgqp7tgrn2vrjdpxrgid.onion DarkMatter News snapshot · 2026-08-06 21:29
  • b5jdmol4jue65sgfigts5433by6idbhaxlvsmqqvdss6xdn6hhlwfkqd.onion DarkMatter News snapshot · 2026-08-06 21:00
  • 3wyuqt7wny2v6nyl5riitwczbhdy666b2cvzwueicbhplkmkodemqsid.onion DarkMatter News snapshot · 2026-08-06 21:00
  • 4zk3pam4s3kndvxmbc7mztpypkxxum2jruzgn3ewhvaza56dyrinjjyd.onion DarkMatter News snapshot · 2026-08-06 21:29
  • wnfjxzpjmuguv6wguvymyppijk66lmrklfopktldu3wel665gexgxcad.onion DarkMatter News snapshot · 2026-08-06 21:39
  • dh4yyjryrmltf6272ff52je5j3dudwcdn7apeqzjt2qvhfi6njlgfaad.onion DarkMatter News snapshot · 2026-08-06 21:24
  • ra7lgaktgbmlnaw2c7eq5l5aj5lcw4dlguyoutwrmjettzmgo3pbhqad.onion DarkMatter News snapshot · 2026-08-06 21:00
  • 5wctasaofkogqjfqkchapdf6icjwj257fgyvrigltvgsjch3giobu5qd.onion DarkMatter News snapshot · 2026-08-06 21:37
  • jswcizzyx7xznkpzvbted32mdreok47u3f4vcmmsjl67nug3qffmreqd.onion DarkMatter News snapshot · 2026-08-06 21:13
  • bqk2ykk5mf4gkijej4moiaqguld5mrotwy3uqu52dzk6angqhszdulqd.onion DarkMatter News snapshot · 2026-08-06 21:13
  • hydk3hd2rfbo7qzgevu34fnvx7walros4u4yfzk3t7fmpm5lwb2palad.onion DarkMatter News snapshot · 2026-08-06 21:35
  • jn5y5vasxg5jpnjscyy3jlvamyt522ljhsfqsgxmnjd4lwrdre2ozyid.onion DarkMatter News snapshot · 2026-08-06 21:00
  • 2aky5g6peubjdzzlulcd4xsb7aqsk52qta3s7akxjakynefjplcp43ad.onion DarkMatter News snapshot · 2026-08-06 21:31

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.