THREAT ACTOR
J-GROUP_
DormantJ-GROUP is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of J-GROUP, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 42
Leak site mirrors
3 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
twniiyed6mydtbe64i5mdl56nihl7atfaqtpww6gqyaiohgc75apzpad.onionHome | J Blog snapshot · 2025-12-15 14:10 -
w4d5aqmdxkcsc2xwcz7w7jo6wdmvmakgy3y6mfmdtzmyvxe77cjkfbad.onionJ snapshot · 2026-01-21 17:30 -
share.jtor.xyzjtor.xyz | 522: Connection timed out snapshot · 2026-07-04 13:17
Recent victims
The 50 most recent victims claimed by J-GROUP. Total in the index: 42.
| Date listed | Victim | Description |
|---|---|---|
| 2025-11-09 | ikad.com.au - A 5-Month Staycation in the Defense Supply Chain | |
| 2025-11-01 | ****.com.au | |
| 2025-10-01 | Dimensional Control Systems (3dcs.com) | |
| 2025-09-30 | multi-media systeme AG (mmsag.de) | |
| 2025-09-30 | AZpro Group (azprogroup.com) | |
| 2025-09-29 | Petro-Diamond (petrodiamond.com) - subsidiary of Mitsubishi Corporation | |
| 2025-09-29 | J. E. Stacey & Co. Ltd (jestacey.com) | |
| 2025-09-29 | raimore.com | |
| 2025-09-29 | Virtual Projects (virtualprojects.build) | |
| 2025-09-24 | FAI Aviation Group (fai.ag) - The biggest leak ever | |
| 2025-08-20 | southweststone.net | |
| 2025-08-19 | Gimaex.com Security is Broken: Fire Truck Company Loses Data | |
| 2025-08-14 | a********p.com | |
| 2025-08-05 | ppmrecruit.com | |
| 2025-08-05 | aym.com.mx | |
| 2025-07-31 | bridgerecruit.co.uk | |
| 2025-07-30 | restiani.com | |
| 2025-07-30 | gimaex.com | |
| 2025-07-28 | sou***********.net | |
| 2025-07-10 | rhodar.co.uk | |
| 2025-06-23 | fecovita.com | |
| 2025-06-20 | cisin.com | |
| 2025-06-20 | powells.biz | |
| 2025-06-20 | diffazur.fr | |
| 2025-06-02 | venezolanadepinturas.com | |
| 2025-06-01 | daycohost.com | |
| 2025-06-01 | nokotapackers.com | |
| 2025-06-01 | immobilia.hu | |
| 2025-05-12 | psec.com.ar | |
| 2025-05-12 | bouygues-es.fr | |
| 2025-05-12 | ratnasagar.com | |
| 2025-05-12 | brdigital.net.br | |
| 2025-05-12 | ferretornillos.com | |
| 2025-05-02 | uva.edu.br | 17 Feb 2025 Universidade Veiga de Almeida (Veiga de Almeida Univers… |
| 2025-05-02 | ausfec1.com.au | 22 Feb 2025 ausfec1.com.au Revenue: $? Data: 204 Gb |
| 2025-05-02 | rosekennedygreenway.org | 23 Feb 2025 The Rose Kennedy Greenway is a contemporary public park… |
| 2025-05-02 | jean-petit.lu | 2 Mar 2025 Company that operates in the Architecture, Engineering &… |
| 2025-05-02 | atp.chaco.gob.ar | 3 Mar 2025 **Administración Tributaria Provincial is a company that… |
| 2025-05-02 | l-a.com.vn | 3 Mar 2025 Founded in 2001, with twelve years operating in the fiel… |
| 2025-05-02 | automobile-mueller.info | 13 Mar 2025 Autohaus Müller Leipzig **Revenue: ** $25,000,000… |
| 2025-05-02 | laticrete.com.cn | 13 Mar 2025 LATICRETE International Inc is a company that operates … |
| 2025-05-02 | mygoalseek.com | 13 Mar 2025 GoalSeek Shared Services Pvt Ltd is a company that oper… |
CONFIRMED ATTACKS
J Group confirmed attacks: 2 verified incidents
Ransomnews has verified 2 J Group incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2025 to October 2025. Australia accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is manufacturing, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified J Group incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| October 2025 | IKAD Engineering Pty Ltd | Manufacturing | Henderson, Australia | — | Unknown | Source |
| March 2025 | Administración Tributaria Provincial (ATP) Chaco | Government | Resistencia, Argentina | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from J Group's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.