THREAT ACTOR
DISPOSSESSOR_
DormantDISPOSSESSOR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of DISPOSSESSOR, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2024 44
- 2023 187
- 2022 54
- 2021 28
- 2020 24
Leak site mirrors
7 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onionDispossessor.com snapshot · 2024-08-12 14:08 -
cybertube.videosnapshot · 2025-01-27 16:24 -
e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onionsnapshot · 2024-08-12 14:00 -
dispossessor.comDNS resolution error | dispossessor.com | Cloudflare snapshot · 2025-06-26 08:03 -
dispossessor-cloud.comDNS resolution error | dispossessor-cloud.com | Cloudflare snapshot · 2025-06-26 08:01 -
cybernewsint.comDNS resolution error | cybernewsint.com | Cloudflare snapshot · 2025-06-26 19:01 -
redhotcypher.comDNS resolution error | redhotcypher.com | Cloudflare snapshot · 2025-06-26 18:26
Recent victims
The 50 most recent victims claimed by DISPOSSESSOR. Total in the index: 337.
| Date listed | Victim | Description |
|---|---|---|
| 2024-11-24 | careservicesllc.com | careservicesllc.com |
| 2024-11-06 | hubbell.com | hubbell.com |
| 2024-10-11 | hess.com | hess.com |
| 2024-10-01 | datasite.com | datasite.com |
| 2024-09-18 | cadencebank.com | cadencebank.com |
| 2024-09-12 | pioneerelectronics.com | pioneerelectronics.com |
| 2024-09-05 | crowe.com | crowe.com |
| 2024-08-11 | https://parkerdevco.com | Company name: Parker Development. Address: 4525 Serrano Parkway, Suite… |
| 2024-08-09 | agilysys.com | agilysys.com |
| 2024-08-05 | Zon Beachside https://zonbeachside.com | Listing of stolen data: https://privatebin.net/?993961372f61c5ff#C1GvR… |
| 2024-08-02 | gensler.com | gensler.com |
| 2024-08-01 | TNT Materials https://tnt-materials.com/ | Data of company. Can be downloaded using Bittorrent / uTorrent. Part1… |
| 2024-08-01 | County Linen UK | Data of company. Can be downloaded using Bittorrent / uTorrent. Part1… |
| 2024-07-29 | https://qatar.vcu.edu | https://streamable.com/k5439m - VCUarts Qatar files 10 minutes video. … |
| 2024-07-29 | https://tursso.com | https://streamable.com/ixp9fn + https://streamable.com/2l7h7x videos o… |
| 2024-07-29 | http://airedentalarts.com | https://streamable.com/tkc7xk - video of files part1. After the timeli… |
| 2024-07-28 | delhihospital.com | Richland Parish Hospital Video of files 10 minutes - https://streamabl… |
| 2024-07-24 | radissonhotelsamericas.com | radissonhotelsamericas.com |
| 2024-07-09 | marykay.com | marykay.com |
| 2024-07-03 | olympusgrp.com Part1 | Olympus Group representative (his email [email protected]) b… |
| 2024-06-28 | fidelia-consulting.com PART2 | youtube.com and cybertube.com links to view in this blog post will be … |
| 2024-06-28 | notablefrontier.com | notablefrontier.com |
| 2024-06-27 | fidelia-consulting.com | Fidelia Consulting is an experienced accounting firm located in Nanter… |
| 2024-06-16 | garrettmotion.com | garrettmotion.com |
| 2024-06-12 | energytransfer.com | energytransfer.com |
| 2024-06-04 | UMAPS - PART2 | VIDEO OF FILES PART1 - http://cybertube.video/web/index.html#!/details… |
| 2024-05-21 | netscout.com | netscout.com |
| 2024-05-21 | UMBRELLA PROPERTIES PART2 | VIDEO OF FILES PART1 - http://cybertube.video/web/index.html#!/details… |
| 2024-05-13 | umbrellaproperties.com | Umbrella Properties offers apartments, duplexes and townhouses for ren… |
| 2024-04-27 | pwc.com | pwc.com |
| 2024-04-24 | navalaviationmuseum.org | The National Naval Aviation Museum is the world’s largest Naval Aviati… |
| 2024-04-22 | nationalflightacademy.com | VIDEO OF FILES PART1: http://cybertube.video/web/index.html#!/details?… |
| 2024-04-06 | amctheatres.com | amctheatres.com |
| 2024-03-28 | salelytics.com | salelytics.com |
| 2024-03-28 | myhomecarellc.com | M&Y Care is a privately-owned home care services company founded in 19… |
| 2024-03-20 | umaps.hn | The "Unidad Municipal de Agua Potable y Saneamiento" (Municipal Unit o… |
| 2024-03-15 | ventivtech.com | ventivtech.com |
| 2024-03-12 | lipsg.com | As the largest practice of its kind in the United States, New York Pla… |
| 2024-02-26 | signatureperformance.com | The company Signature Performance is dedicated to transforming healthc… |
| 2024-02-10 | mesvision.com | mesvision.com |
| 2024-02-10 | unidad-de-oftalmologia-y-catarata.negocio.site | The company Unidad de Oftalmología y Catarata transform the quality of… |
| 2024-02-10 | mechema.com | MECHEMA CHEMICALS INTERNATIONAL CORP is a company founded in 1981 with… |
| 2024-02-10 | ducont.com | The company Ducont is the leading IT Products & Services provider in t… |
| 2024-01-19 | quark.com | quark.com |
| 2023-12-30 | brownintegratedlogistics.com | 1 part of data. Brown Integrated Logistics, through its subsidiarie… |
| 2023-12-25 | co.pickens.sc.us | Welcome to Pickens County, SC |
| 2023-12-25 | hendelsinc.com | Hendels, Inc distributes petroleum and petroleum products. The Company… |
| 2023-12-25 | ontariopork.on.ca | Ontario Pork Producers’ Marketing Board (OPPMB or Ontario Pork), is th… |
| 2023-12-22 | eastwestbank.com | eastwestbank.com |
| 2023-12-20 | dobsystems.com | We are the leader in airline industry data processing and provide a su… |
CONFIRMED ATTACKS
Dispossessor confirmed attacks: 3 verified incidents
Ransomnews has verified 3 Dispossessor incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2024 to July 2024. United States accounts for 2 of them (67%), with victims recorded in 2 countries in total. The most affected sector is healthcare, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 2. Where a figure was disclosed (2 cases), these incidents account for 14,165 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Dispossessor incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2024 | Virginia Commonwealth University School of the Arts Qatar (VCUarts Qatar) | Education | Doha, Qatar | 3,965 | Unknown | Source |
| July 2024 | Delhi Hospital (Richland Parish Hospital) | Healthcare | Louisiana, United States | — | No | Source |
| June 2024 | PG Dental PLLC d/b/a Aire Dental Art | Healthcare | New York, United States | 10,200 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Dispossessor's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.