Close Menu

DARKMATTER · Threat actor profile

// THREAT ACTOR

DARKMATTER_

Active

DARKMATTER is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of DARKMATTER — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

0 Victims tracked
14 / 17 Active mirrors
— First listing
— Most recent

Leak site mirrors

17 mirrors tracked, 14 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • s42fv44x5r2ubrrydl5edh4srwch7sr3j7goy34sfuaqhcqbfwhuqyad.onion snapshot · 2026-08-11 23:25
  • rda6wisv3wkznfz5uimkbr5bmqdeynocjxnk67li4x4sud35hcclgwid.onion snapshot · 2026-08-11 23:01
  • 2el6bpoz2ely34iqcmxsiicpdmzp37jjtsggxwukbk5jx6x6bdxbh3ad.onion snapshot · 2026-08-11 23:04
  • ydq4dhq6kel2bcfdvukjodffob6a6qswemadm36mt3e4wb2rlespxdyd.onion snapshot · 2026-08-11 23:02
  • 7o7himec23q5yl4qkzaqkadj3oqtp5rd6rjcrgqp7tgrn2vrjdpxrgid.onion snapshot · 2026-08-11 23:21
  • b5jdmol4jue65sgfigts5433by6idbhaxlvsmqqvdss6xdn6hhlwfkqd.onion snapshot · 2026-08-11 23:07
  • 3wyuqt7wny2v6nyl5riitwczbhdy666b2cvzwueicbhplkmkodemqsid.onion snapshot · 2026-08-11 23:01
  • 4zk3pam4s3kndvxmbc7mztpypkxxum2jruzgn3ewhvaza56dyrinjjyd.onion snapshot · 2026-08-11 22:28
  • wnfjxzpjmuguv6wguvymyppijk66lmrklfopktldu3wel665gexgxcad.onion snapshot · 2026-08-11 23:10
  • dh4yyjryrmltf6272ff52je5j3dudwcdn7apeqzjt2qvhfi6njlgfaad.onion snapshot · 2026-08-12 00:00
  • ra7lgaktgbmlnaw2c7eq5l5aj5lcw4dlguyoutwrmjettzmgo3pbhqad.onion snapshot · 2026-08-11 23:23
  • 5wctasaofkogqjfqkchapdf6icjwj257fgyvrigltvgsjch3giobu5qd.onion snapshot · 2026-08-12 00:00
  • jswcizzyx7xznkpzvbted32mdreok47u3f4vcmmsjl67nug3qffmreqd.onion snapshot · 2026-08-11 22:16
  • bqk2ykk5mf4gkijej4moiaqguld5mrotwy3uqu52dzk6angqhszdulqd.onion snapshot · 2026-08-11 23:00
  • hydk3hd2rfbo7qzgevu34fnvx7walros4u4yfzk3t7fmpm5lwb2palad.onion snapshot · 2026-08-12 00:00
  • jn5y5vasxg5jpnjscyy3jlvamyt522ljhsfqsgxmnjd4lwrdre2ozyid.onion snapshot · 2026-08-11 23:02
  • 2aky5g6peubjdzzlulcd4xsb7aqsk52qta3s7akxjakynefjplcp43ad.onion snapshot · 2026-08-12 00:01

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.