// THREAT ACTOR
HELLOGOOKIE_
DormantHELLOGOOKIE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of HELLOGOOKIE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2024 3
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
gookie256cvccntvenyxrvn7ht73bs6ss3oj2ocfkjt5y6vq6gfi2tad.onionHelloGookie snapshot · 2024-07-17 13:07
Recent victims
The 50 most recent victims claimed by HELLOGOOKIE. Total in the index: 3.
| Date listed | Victim | Description |
|---|---|---|
| 2024-04-20 | Hey everyone! Some private keys here. | LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBNENoOD… |
| 2024-04-20 | Hey cisco! | You lied to us and play for time to kick us out. We will meet you soo… |
| 2024-04-20 | CD Projekt! | How you doin? I just remembered some passwords... do you have it? ah,… |