THREAT ACTOR
FUNKSEC_
ActiveFUNKSEC is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of FUNKSEC, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 96
- 2024 108
Leak site mirrors
13 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
7ixfdvqb4eaju5lzj4gg76kwlrxg4ugqpuog5oqkkmgfyn33h527oyyd.onionFunksec snapshot · 2024-12-30 08:00 -
pke2vht5jdeninupk7i2thcfvxegsue6oraswpka35breuj7xxz2erid.onionFunksec snapshot · 2024-12-28 19:11 -
ykqjcrptcai76ru5u7jhvspkeizfsvpgovton4jmreawj4zdwe4qnlid.onionFunksec snapshot · 2024-12-06 09:01 -
funknqn44slwmgwgnewne6bintbooauwkaupik4yrlgtycew3ergraid.onionNew Address Blog snapshot · 2026-09-22 21:28 -
funkxxkovrk7ctnggbjnthdajav4ggex53k6m2x3esjwlxrkb3qiztid.onionNew Address Blog snapshot · 2026-09-23 00:17 -
funkiydk7c6j3vvck5zk2giml2u746fa5irwalw2kjem6tvofji7rwid.onionNew Address Blog snapshot · 2026-09-22 18:25 -
funk4ph7igelwpgadmus4n4moyhh22cib723hllneen7g2qkklml4sqd.onionFunkforum snapshot · 2025-03-20 07:03 -
funkyiazgfsrxrib6rnxbhkgfqi7isisfbqnwk2ycf7tpgfhtevlamad.onionMarketplace - Home Page snapshot · 2025-01-29 17:07 -
funksec.topAnon Hosting - Hidden Services snapshot · 2025-06-05 06:00 -
funksec53xh7j5t6ysgwnaidj5vkh3aqajanplix533kwxdz3qrwugid.onionFunksec v3.0 snapshot · 2025-04-13 13:21 -
funksecsekgasgjqlzzkmcnutrrrafavpszijoilbd6z3dkbzvqu43id.onionFunksec v3.0 snapshot · 2025-04-13 14:07 -
funksec7vgdojepkipvhfpul3bvsxzyxn66ogp7q4pptvujxtpyjttad.onionFunksec v3.0 snapshot · 2025-04-13 14:15 -
funk45xqgrkrtej4743evcgv65oi3w4shwvjx3cvrdtqwul7gzkxuxqd.onionContact Form - FunkLocker Support snapshot · 2025-03-20 07:00
Recent victims
The 50 most recent victims claimed by FUNKSEC. Total in the index: 204.
| Date listed | Victim | Description |
|---|---|---|
| 2025-03-19 | semaphore.asso.fr | |
| 2025-03-15 | sanirent.com.mx | |
| 2025-03-12 | extremeperformance.com | |
| 2025-03-12 | unimore.it | |
| 2025-03-11 | Urgent Warning to University of Rennes – Negotiate Now! | |
| 2025-03-11 | isee-eg.com | |
| 2025-03-09 | klabs.it | |
| 2025-03-08 | sorbonne-universite.fr | |
| 2025-03-08 | univ-rennes.fr | |
| 2025-03-04 | cimenyan.desa.id | |
| 2025-02-28 | mytower.com.br | |
| 2025-02-28 | stayzapp.in | |
| 2025-02-28 | Moon | |
| 2025-02-28 | Read | |
| 2025-02-28 | mandarin.com.br | |
| 2025-02-21 | Hexagon extortion | |
| 2025-02-19 | rossmanmedia.ae | |
| 2025-02-19 | rossmanmedia.ae seized by usa | |
| 2025-02-18 | footballticketnet.com | |
| 2025-02-17 | hiway.com.br | |
| 2025-02-16 | fasttrackcargo.com | |
| 2025-02-16 | dms-ksa.com | |
| 2025-02-14 | fasttrackcargo.com | About fasttrackcargo.com Fast Track Cargo is a logistics and transp… |
| 2025-02-14 | forum-rainbow-rp.forumotion.eu | forum-rainbow-rp.forumotion.eu first one this forum controlled by f… |
| 2025-02-14 | Script kiddies & newbe researchers | Script kiddies with researchers after target script kiddies and res… |
| 2025-02-14 | tsmx.net.br | About tsmx.net.br is system managment help users to manage thier we… |
| 2025-02-14 | treehotel.co.uk | About treehotel.co.uk Treehotel.co.uk refers to the website for a u… |
| 2025-02-14 | dms-ksa.com | About dms-ksa.com Digital Myth Solutions (DMS) is a leading technol… |
| 2025-02-14 | myisp.live | About myisp.live Internet Service Provider Company . - 100k user… |
| 2025-02-14 | inmobiliariamaspormenos.com | About inmobiliariamaspormenos.com Management and sale of bank-owned… |
| 2025-02-14 | fiberskynet.net | About FiberSkynet FiberSkynet is an internet service provider (ISP)… |
| 2025-02-14 | tirtaraharja.co.id | About tirtaraharja.co.id Perumda Air Minum Tirta Raharja is a regio… |
| 2025-02-14 | hreu.eu | About hreu.eu HrEU is a human resources agency specializing in conn… |
| 2025-02-14 | punjab.gov.in | punjab.gov.in What we exfiltrated PDfs , 1GB data reports , phon… |
| 2025-02-14 | Breached brainsystem.eu | No pay, will be leaked. brainsystem.eu 400GB for free to download C… |
| 2025-02-14 | cara.com.my | |
| 2025-02-14 | rattelacademy.com | |
| 2025-02-14 | autogedal.ro | |
| 2025-02-14 | iaaglobal.org | |
| 2025-02-14 | herbalcanadaonline.com | |
| 2025-02-14 | phidac.be | |
| 2025-02-14 | avtovelomoto.by | |
| 2025-01-28 | FunkBID | |
| 2025-01-28 | tsmx.net.br | |
| 2025-01-27 | treehotel.co.uk | |
| 2025-01-27 | qed.co.ug | |
| 2025-01-26 | achieverssciencejournal.org | |
| 2025-01-26 | FunkYkosmos | |
| 2025-01-26 | punjab.gov.in | |
| 2025-01-26 | ransom price is 10k for all |
CONFIRMED ATTACKS
Funksec confirmed attacks: 9 verified incidents
Ransomnews has verified 9 Funksec incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from December 2024 to March 2025. Spain accounts for 2 of them (22%), with victims recorded in 8 countries in total. The most affected sector is food and beverage, at 2 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 8.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Funksec incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2025 | Université de Rennes | Education | Rennes, France | — | Unknown | Source |
| January 2025 | The Tree Hotel | Other | Oxford, United Kingdom | — | Unknown | Source |
| January 2025 | Achievers Journal of Scientific Research | Education | Owo, Nigeria | — | Unknown | Source |
| January 2025 | City Bank PLC | Finance | Dhaka, Bangladesh | — | Unknown | Source |
| January 2025 | Department of Children and Family - Bayan-Olgii Province | Government | Bayan-Olgii, Mongolia | — | Unknown | Source |
| January 2025 | Ribernuez | Food and Beverage | Valladolid, Spain | — | Unknown | Source |
| December 2024 | Netox | Technology | Martyr Kamil, Turkey | — | Unknown | Source |
| December 2024 | Fresh Produce Safety Centre Australia & New Zealand (FPSC-ANZ) | Food and Beverage | Eveleigh, Australia | — | No | Source |
| December 2024 | Deportes Apalategui | Retail | Donostia-San Sebastian, Spain | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Funksec's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.