THREAT ACTOR
GENESIS_
ActiveGENESIS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of GENESIS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 107
- 2025 24
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onionGENESIS snapshot · 2026-11-10 22:01
Recent victims
The 50 most recent victims claimed by GENESIS. Total in the index: 131.
| Date listed | Victim | Description |
|---|---|---|
| 2026-11-06 | Xinos Construction | A construction management company. |
| 2026-11-06 | Insation Technologies | A provider of IT services |
| 2026-10-30 | Acclaim Companies / JCJ Investment | A privately-held, real estate development and property management comp… |
| 2026-10-30 | Gilliam & Associates, P.C | A full service CPA firm. |
| 2026-10-30 | Facts N Figures | A consumer insights research company. |
| 2026-10-30 | Illinois Work Injury Resource Center (IWIRC) | A comprehensive occupational health and rehabilitation service provide… |
| 2026-10-30 | Psychometrics Canada | A company that works in the science of objective assessments for over … |
| 2026-10-30 | Louisiana Crane & Construction | A construction management company. |
| 2026-10-30 | Aliqout Association | A multi-disciplinary civil engineering firm based in Walnut Creek, CA. |
| 2026-10-30 | EAS Engineering | Specializes in navigating wetland regulations for landowners, develope… |
| 2026-10-30 | Fred H Beck & Associates | A regional commercial real estate services firm based in Charlotte, No… |
| 2026-10-28 | A&B Lab | Provides Laboratory Services. |
| 2026-10-01 | VPNE | A company that specializes in managing people, transportation and othe… |
| 2026-10-01 | TLC Perinatal | A provider of healthcare services. |
| 2026-10-01 | Vera Science | A Biotechnology Company |
| 2026-10-01 | Owens Distributors | Specializes in providing industrial machinery & equipment services |
| 2026-09-15 | Bernath & Rosenberg | A full service CPA firm |
| 2026-09-15 | Dorfman Abrams Music, P.C | A full service CPA firm |
| 2026-08-25 | S******* | An International Public Company |
| 2026-08-23 | Hospitality Health ER (Longview) | A healthcare organization |
| 2026-08-12 | **E*** | A healthcare organization |
| 2026-08-11 | Consolidated Medical Practices of Memphis | A healthcare organization |
| 2026-08-11 | Interim HealthCare | A healthcare organization dealing with elderly care services |
| 2026-07-31 | **** | A healthcare organization |
| 2026-07-31 | Boyum IT Solutions (HOT!) | A provider of IT services |
| 2026-07-31 | C.A. Walker Construction | A construction management company |
| 2026-07-27 | Williams Accounting Professional | A full service CPA firm |
| 2026-07-27 | JJP Slip Forming Inc. | A company that operates in the Restaurants industry |
| 2026-07-27 | Building Envelope Systems | A reputable construction company based in Plainville, MA |
| 2026-07-27 | Westlake Realty Group, Inc. | A full-service real estate development company |
| 2026-07-27 | Servonix Technologies | A provider of IT services |
| 2026-07-27 | Infinity Pipeline,Inc. | A family owned, local construction company. |
| 2026-07-05 | Apex Agro, LLC | A Chemical Production Company |
| 2026-07-05 | Mirage Endoscopy Center | A healthcare organization |
| 2026-07-05 | Bri-Tech, Inc | A technology design and integration firm |
| 2026-07-05 | SBI Software | An Enterprise Resource Planning Software Provider |
| 2026-07-05 | DICON | A general contracting construction firm |
| 2026-07-05 | Westgate | A construction management company |
| 2026-07-05 | Dunagan Associates | Provides services in residential real estate and insurance |
| 2026-07-05 | Synergy Interactive | A provider of staffing services |
| 2026-07-05 | East Texas Family Medicine | A healthcare organization |
| 2026-06-30 | Brooklyn Defender Services | A legal organization dedicated to safeguard the rights of its clients |
| 2026-06-18 | United Personnel (a division of Masis Staffing Solutions) | A provider of staffing services |
| 2026-06-18 | The Associated Builders and Contractors of Indiana/Kentucky | A trade association |
| 2026-06-06 | *B* | A trade association |
| 2026-06-05 | Family Medical Associates of Raleigh | A healthcare organization |
| 2026-05-30 | Cavalier Flooring Systems Inc. | A flooring and tile contractor |
| 2026-05-30 | Wentworth | the DC Metro area's premier design-build firm |
| 2026-05-30 | Green Resource | A leading distributor of professional fertilizers, chemicals, and seed… |
| 2026-05-30 | Cedar Street Capital (A part of a Cynvestors Limited Partnership) | A private investment entity associated with Cynthia Stiehl |
CONFIRMED ATTACKS
Genesis confirmed attacks: 16 verified incidents
Ransomnews has verified 16 Genesis incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from September 2025 to July 2026. United States accounts for 15 of them (94%), with victims recorded in 2 countries in total. The most affected sector is healthcare, at 8 confirmed victims. Where a figure was disclosed (3 cases), these incidents account for 615,806 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Genesis incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Hospitality Health ER (Longview) | Healthcare | Texas, United States | — | Unknown | Source |
| May 2026 | Peña & Bromberg | Legal | California, United States | — | Unknown | Source |
| April 2026 | Family Medical Associates of Raleigh | Healthcare | North Carolina, United States | 500 | Unknown | Source |
| March 2026 | American Board of Preventive Medicine | Other | United States | — | Unknown | Source |
| March 2026 | CarePoint Health | Healthcare | Mississauga, Canada | — | Unknown | Source |
| February 2026 | City of Hart | Government | Michigan, United States | — | Unknown | Source |
| January 2026 | National Association on Drug Abuse Programs, Inc. (NADAP) | Other | New York, United States | 90,000 | Unknown | Source |
| December 2025 | Sierra Management Group Inc. | Healthcare | California, United States | — | Unknown | Source |
| December 2025 | IMA Diligence Services, LLC | Finance | Illinois, United States | 525,306 | Unknown | Source |
| December 2025 | Stockton Cardiology Medical Group | Healthcare | California, United States | — | Unknown | Source |
| December 2025 | Upper Township | Government | New Jersey, United States | — | Unknown | Source |
| November 2025 | Surgery Center of Oak Ridge, LLC dba Advanced Family Surgery Center | Healthcare | Tennessee, United States | — | Unknown | Source |
| October 2025 | Dill Dill Carr Stonbraker & Hutchings, P.C. | Other | United States | — | Unknown | Source |
| October 2025 | Community Health Action of Staten Island | Healthcare | New York, United States | — | Unknown | Source |
| September 2025 | River City Eye Care, LLC | Healthcare | Oregon, United States | — | Unknown | Source |
| September 2025 | Road To Hana, Inc. d/b/a Healthy Living | Food and Beverage | Vermont, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Genesis's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.