// THREAT ACTOR
ICARUS_
DormantICARUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of ICARUS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 13
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
e6ujsppajgb756x7x5ykdryvlcjynltb52eiwi6pd4bfwo6hddd6neid.onionIcarus snapshot · 2026-06-23 18:17
Recent victims
The 50 most recent victims claimed by ICARUS. Total in the index: 13.
| Date listed | Victim | Description |
|---|---|---|
| 2026-06-23 | H* | Salesforce data of H*. |
| 2026-06-23 | H** | Salesforce data for this corp. |
| 2026-06-23 | G* | Salesforce data for this corp. |
| 2026-06-23 | C* | Salesforce data for this corp. |
| 2026-06-22 | Huntress | Salesforce data of Huntress. |
| 2026-06-22 | HDS (Hdscorp) | Salesforce data for this corp. |
| 2026-06-22 | Gms-net | Salesforce data for this corp. |
| 2026-06-22 | Cqcrm | Salesforce data for Cqcrm |
| 2026-06-22 | Cbassociations | Salesforce data for this corp. |
| 2026-06-20 | DEADLINE MONDAY | All klue.com clients who have been contacted by us have till... |
| 2026-06-19 | Klue.com | As you've probably already heard, Klue.com has been impacted... |
| 2026-06-16 | thecreditpros.com | TheCreditPros' Salesforce instance was breached and 263MB of... |
| 2026-05-05 | Cazh.id | - User DB: 300,000 Users (Email, Hash, Phone, Address, DOB) ... |