// THREAT ACTOR
ICEFIRE_
DormantICEFIRE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of ICEFIRE — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2022 55
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
kf6x3mjeqljqxjznaw65jixin7dpcunfxbbakwuitizytcpzn4iy5bad.onionLeakage List snapshot · 2022-08-24 14:04 -
7kstc545azxeahkduxmefgwqkrrhq3mzohkzqvrv7aekob7z3iwkqvyd.onionLeakage List snapshot · 2023-03-13 02:06 -
nxx3cy6aee2s53v7v5pxrfv7crfssw7hmgejbj47cv6xuak3bgncllqd.onionsnapshot · 2024-12-10 04:24
Recent victims
The 50 most recent victims claimed by ICEFIRE. Total in the index: 55.
| Date listed | Victim | Description |
|---|---|---|
| 2022-08-27 | *.algotrader.com | |
| 2022-08-27 | *.bestservers.pro | |
| 2022-08-27 | *.iperactive.com.ar | |
| 2022-08-27 | *.cco1.com | |
| 2022-08-27 | *.vps-vds.com | |
| 2022-08-27 | *.guneshosting.com | |
| 2022-08-27 | *.kodhosting.com | |
| 2022-08-27 | *.kru.ac.th | |
| 2022-08-27 | *.directfn.net | |
| 2022-08-27 | *.feesh.ch | |
| 2022-08-27 | *.skifgroup.com | |
| 2022-08-18 | P*CMaZOv-**** | |
| 2022-08-18 | Pphlz6&B%:7=**** | |
| 2022-08-18 | SaY@fXTS5xJV**** | |
| 2022-08-18 | p*GMz5VBONF~**** | |
| 2022-08-18 | pxh+c6Q_77LH**** | |
| 2022-08-18 | pxhGu5Vi@O=8**** | |
| 2022-08-18 | SM|bK2Xe0 | |
| 2022-08-18 | Slm|ON)HeLG{**** | |
| 2022-08-18 | pY(l8ZRVO:fN**** | |
| 2022-08-18 | pY(9z8V#Nmr?**** | |
| 2022-08-18 | pY(9?ZV_wE!^**** | |
| 2022-08-18 | Yo(Cu6#R:Pq^**** | |
| 2022-08-18 | WPh(caB_1EwI**** | |
| 2022-08-18 | WPh(caB_1@_X**** | |
| 2022-08-18 | S[m4H | |
| 2022-08-18 | SVRLxrxtuNzT**** | |
| 2022-08-18 | SY{3{3kp9~k#**** | |
| 2022-08-18 | W*h(zqtB%7n0**** | |
| 2022-08-18 | WSC9aa#Vm%cA**** | |
| 2022-08-18 | WPGh5ZD#7@:D**** | |
| 2022-08-18 | pxCM5cDBO%[]**** | |
| 2022-08-18 | pY(C88t_mwZK**** | |
| 2022-08-18 | PX995qBVNOAn**** | |
| 2022-08-18 | YoGMzcV#1Ik2**** | |
| 2022-08-18 | WxlAza#_11wx**** | |
| 2022-08-18 | W | |
| 2022-08-18 | PPMCzuD&7mgQ**** | |
| 2022-08-18 | **** | |
| 2022-08-18 | p | |
| 2022-08-18 | WP(Cz?tR%%@***** | |
| 2022-08-18 | pXhMc6_V@%7n**** | |
| 2022-08-18 | pS!(6ZDV%@Xo**** | |
| 2022-08-18 | WY9l56tt1Oa9**** | |
| 2022-08-18 | Sk-GMDV=$yQv**** | |
| 2022-08-18 | pxh+caBB%7ye**** | |
| 2022-08-18 | WS((auQQO@Vz**** | |
| 2022-08-18 | S?nISDNf^1[Z**** | |
| 2022-08-18 | Pp9!86t#:OPi**** | |
| 2022-08-18 | SeEI?b*2ZR*1**** |