// THREAT ACTOR
EMPERADOR_
ActiveEMPERADOR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of EMPERADOR — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 8
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onionEMPERADOR snapshot · 2026-08-23 15:00
Recent victims
The 50 most recent victims claimed by EMPERADOR. Total in the index: 8.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-23 | FRUCASTRO SL | Recent databases, important documents Publication scheduled: 2026-09-0… |
| 2026-08-22 | Vietnam Electricity(EVNHANOI) | Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam… |
| 2026-08-22 | Test | test test test Size: 9.8 GB Sectors: Other |
| 2026-08-20 | NetExam | NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS l… |
| 2026-08-18 | Prefeitura Municipal de Arcos | We hold complete, unrestricted access to your internal infrastructure.… |
| 2026-08-16 | Albania's official national teacher training portal. | Albania’s official national teacher training portal provides centraliz… |
| 2026-08-16 | Albania's Official National Teacher Training Portal | Albania’s official national teacher training portal provides centraliz… |
| 2026-08-10 | City Government of Baguio | The City Government of Baguio stands as one of the wealthiest and most… |