THREAT ACTOR
EMPERADOR_
ActiveEMPERADOR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of EMPERADOR, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 40
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onionEMPERADOR snapshot · 2026-10-08 08:00
Recent victims
The 50 most recent victims claimed by EMPERADOR. Total in the index: 40.
| Date listed | Victim | Description |
|---|---|---|
| 2026-10-05 | PANCARIBBEAN LOGISTICS GROUP | Panamanian logistics company operating in the field of international … |
| 2026-10-05 | METROCOLOR S.A. | A Peruvian company from the printing industry. Commercial printing, pa… |
| 2026-10-04 | OMUR HIRDAVAT LTD | A Turkish company engaged in the wholesale and retail trade of constr… |
| 2026-10-01 | LA PONDEROSA | GRANJA AVICOLA LA PONDEROSA Venezuela The corporate purpose is mainly … |
| 2026-09-30 | SitePro Rentals | I have yet to hear a response from SitePro Rentals regarding the data … |
| 2026-09-29 | Polikem | Polikem is a Colombian company dedicated to the development, manufactu… |
| 2026-09-29 | Ontrac | OnTrac's offer to negotiate 'early next week' is unacceptable. Our dea… |
| 2026-09-28 | Amazon Informatica | Amazon Informática LTDA is a prominent Information Technology (IT) sol… |
| 2026-09-28 | Electrolux 2... | Hi Electrolux, im getting kind of inpatient, therefore i might just le… |
| 2026-09-28 | SiteProRentals | SitePro Rentals is a Texas-based construction and industrial equipment… |
| 2026-09-27 | Car Service Abschlepp | CSA Car Service Abschlepp- & Bergungsdienst GmbH Genslerstraße 72, 130… |
| 2026-09-25 | Electrolux & Ontrac | Hello Electrolux & OnTrac, Still no response from you. When we called… |
| 2026-09-23 | OnTrac | OnTrac is a major last-mile e-commerce delivery company formed by the … |
| 2026-09-23 | RECEITA FEDERAL DO BRASIL | MINISTÉRIO DA FAZENDA SECRETARIA DA RECEITA FEDERAL DO BRASIL The arch… |
| 2026-09-20 | Alabama Woman's Health Care | Alabama Woman's Health Care Comprehensive Consultative Medicine, Wellb… |
| 2026-09-20 | Studio Notarile Associato Salvatore Costantino E Anna Favarato | Studio Notarile Associato Salvatore Costantino E Anna Favarato, Follin… |
| 2026-09-19 | Cassias MG Government | network commitment, from government credentials to justice panels, suc… |
| 2026-09-17 | Westbridge Institute of Technology, Inc. | Westbridge Institute of Technology, Inc. is an educational institution… |
| 2026-09-16 | RDA MOTORS S.P.A. | is an Italian company engaged in premium cars. There are many customer… |
| 2026-09-16 | SEVENOAKS s.r.o. | Sevenoaks, S.R.O. is an enterprise based in Czech Republic. Its main … |
| 2026-09-16 | Electrolux | Electrolux Group is a Swedish multinational home-appliance manufacture… |
| 2026-09-13 | Navitrans | Navitrans is a leading Colombian distributor and service provider spec… |
| 2026-09-11 | Nexbex Solutions Private Limited | Nexbex Solutions Private Limited is a technology consulting and softwa… |
| 2026-09-10 | EASY JOB S.A.S. | Colombian Company. Audit and Tax Audit with more than 5 years of exper… |
| 2026-09-09 | Bosnia and Herzegovina Mine Action Center | important documents Publication scheduled: 2026-09-19 12:33:49 UTC Siz… |
| 2026-09-09 | BAYMER | Important documents Publication scheduled: 2026-09-19 11:23:44 UTC Siz… |
| 2026-09-09 | Universal Starch-Chem Allied Ltd | important documents Publication scheduled: 2026-09-19 11:13:14 UTC Siz… |
| 2026-09-05 | Judicial Branch of the Province of Jujuy | The official website of the Judicial Branch of Jujuy, Argentina. It pr… |
| 2026-08-29 | Uniguacu | full commitment of the network having full access to infrastructure, t… |
| 2026-08-28 | Hanwha Renewables | The data contains really sensitive information from 4 PV projects look… |
| 2026-08-27 | Ipro.com(revealdata.com) customer DB + full database backup | Yes, this data has been posted before by ME under a different alias, y… |
| 2026-08-27 | Capitol Mechanics | Capitol Mechanics , fresh databases, important docs Publication schedu… |
| 2026-08-23 | FRUCASTRO SL | Recent databases, important documents Publication scheduled: 2026-09-0… |
| 2026-08-22 | Vietnam Electricity(EVNHANOI) | Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam… |
| 2026-08-22 | Test | test test test Size: 9.8 GB Sectors: Other |
| 2026-08-20 | NetExam | NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS l… |
| 2026-08-18 | Prefeitura Municipal de Arcos | We hold complete, unrestricted access to your internal infrastructure.… |
| 2026-08-16 | Albania's official national teacher training portal. | Albania’s official national teacher training portal provides centraliz… |
| 2026-08-16 | Albania's Official National Teacher Training Portal | Albania’s official national teacher training portal provides centraliz… |
| 2026-08-10 | City Government of Baguio | The City Government of Baguio stands as one of the wealthiest and most… |
CONFIRMED ATTACKS
Emperador confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Emperador incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in September 2026. Argentina accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is legal, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Emperador incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | Studio Notarile Associato Salvatore Costantino E Anna Favarato | Legal | Conegliano, Italy | — | Unknown | Source |
| September 2026 | Poder Judicial de la Provincia de Jujuy | Government | Jujuy, Argentina | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Emperador's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.