THREAT ACTOR

FULCRUMSEC_

Active

FulcrumSec is a ransomware operation tracked through its public leak-site infrastructure. The group runs a double-extortion playbook, file encryption combined with stolen-data publication, and has been adding fresh victim listings throughout 2025–2026.

For Ransomnews editorial coverage of FULCRUMSEC, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

30 Victims tracked

1 / 5 Active mirrors

2025-10-20 First listing

2026-10-23 Most recent

Victims by year

2026 29
2025 1

Leak site mirrors

5 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

gsgot6tua7ffammwdv6vpxkog32b4z7qivtqkxz55afq2hkt2o24w5yd.onion AVNET Leaks - Fulcrum Security snapshot · 2025-10-30 05:00
fulcrumsec.net snapshot · 2026-10-13 19:00
4e3p3in2bl67hxchuwza7qvnpe7pyeloyztr5fnh257fxkovfhappjyd.onion FulcrumSec snapshot · 2026-10-28 19:08
4e3p3in2bl67hxchuwza7qvnpe7pyeloyztr5fnh257fxkovfhappjyd.onion Index of /Shame snapshot · 2026-10-28 19:10
fulcrumsec.vg FulcrumSec snapshot · 2026-11-02 21:00

Recent victims

The 50 most recent victims claimed by FULCRUMSEC. Total in the index: 30.

Date listed	Victim	Description
2026-10-23	EMARKETER
2026-10-19	PingCAP / TiDB Cloud
2026-09-11	Dustin Group
2026-09-01	Manchester Airports Group
2026-06-16	Novo Nordisk
2026-06-10	Global Schools Foundation
2026-05-10	Arup Group
2026-05-08	Stuf Storage
2026-04-29	Nordstern Technologies
2026-04-29	ParkEngage
2026-04-29	Saleskido
2026-04-29	Interzero
2026-04-29	IMEVI
2026-04-29	Rotary Club
2026-04-29	JOT
2026-04-29	BookBlock
2026-04-29	Crank Communications
2026-04-29	CrediElite
2026-04-29	Fashinza
2026-04-29	Avnet
2026-04-29	Raptor Supplies
2026-04-29	Lena Health
2026-04-29	Woundtech
2026-04-29	youX / Drive IQ
2026-04-29	LexisNexis
2026-04-29	MCO
2026-04-29	ReFocus AI
2026-04-29	Hatica
2026-04-29	Analog Gold / Prospector
2025-10-20	The Avnet Leaks	We at FulcrumSec completely compromised Avnet's vast infrastructure, w…

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.