THREAT ACTOR
M3RX_
ActiveM3RX is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of M3RX, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 38
Leak site mirrors
2 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
pippahtohg6qgioqu3ixrsueefuw7thythmmeanyrgwn3eixcuu6jvqd.onionsnapshot · 2026-05-03 09:22 -
4k6plf4h2cm2nco6ae3inrsxnmqgl6lllmwefydhnlcq4tuhwbj4qpad.onionM3RX Data Leak Site snapshot · 2026-09-23 05:35
Recent victims
The 50 most recent victims claimed by M3RX. Total in the index: 38.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-29 | lindner-group.com | Lindner Group is Europe's leading manufacturer and service provider sp… |
| 2026-08-14 | tecnoabi.com | Tecnologías de Código Abierto S.L., trading as Tecnoabi, is a Málaga, … |
| 2026-07-26 | hydraulic-components.net | +44 1142764430 , VHS Hydraulics is a prominent supplier of hydraulic c… |
| 2026-07-26 | createinfor.pt | +351 262187684 , CreateInfor is a company that operates in the Repair … |
| 2026-07-26 | servicebypremier.com | +1(954) 646-0016 , This local HVAC and Refrigeration company, establis… |
| 2026-07-24 | ausproof.com.au | +61 749784000 , AusProof is a leader in the design and manufacture of … |
| 2026-07-22 | ubfreight.com | UB Freight is a leading provider of worldwide freight services, specia… |
| 2026-07-17 | suppcentersa.com | +506 40003397. SuppCenter Global Services officially positions itself … |
| 2026-07-17 | arambol.co.uk | +44 2079276370 , Arambol LLP is a dynamic partnership of chartered sur… |
| 2026-07-12 | eclective.ie | Ireland, 41a Pleasants Saint Kevins St, D08 KR99 ,Eclective is Ireland… |
| 2026-07-12 | foreconinc.com | +1 (716) 664-5602 , FORECON Inc. specializes in custom-crafted forest … |
| 2026-07-12 | wrtworld.com | +1 (305) 884-3700 , WRT World Enterprises is a leading provider of pur… |
| 2026-06-11 | hbexperts-conseils.ca | +1 (514) 882-6463. HB Consultants is a consulting firm with over 45 ye… |
| 2026-06-11 | werkstoff-service.de | +49 2013168440. W.S. Werkstoff Service GmbH specializes in material en… |
| 2026-06-11 | fasadeconsult.no | +47 32270200. fasadeConsult Aluminium as specializes in the production… |
| 2026-06-11 | ktwhs.com | +1 (514) 333-5402. KT Group is a leader in Quebec's transport industry… |
| 2026-06-11 | maringoodman.com | +1 9144127301 Fredric Goodman , +1 9144127331 Mr. Richard Marin. Marin… |
| 2026-06-11 | suppcenter.global / suppcentersa.com | +506 40003397. SuppCenter Global Services officially positions itself … |
| 2026-05-27 | jichasa.com | +1 (915) 881-8883. Jichasa Smart Logistics specializes in providing co… |
| 2026-05-17 | grupo55.com | +34 918 892 727. Founded in 1996, Grupo 55 Correduría de Seguros lever… |
| 2026-05-17 | dosocho.es | +34 918 264 028. Recambios Generales del Automóvil Dosocho S.L. is a M… |
| 2026-05-17 | soft-inc.com | +1 212-633-1515. SOFT Inc. is an established American technology consu… |
| 2026-05-17 | psbsementi.it | +39 051 890 421. Società Produttori Sementi S.p.A. (PSB) is one of Ita… |
| 2026-05-07 | alge-stop.dk | +45 22100211 . Alge-Stop helps homeowners and businesses keep their ou… |
| 2026-05-07 | pvdd.ca | +1 (604) 894-6632. Pemberton Valley Dyking District is an autonomous l… |
| 2026-05-07 | datasavior.com | +1 (512) 707-0026. Datasavior is a full-service systems integration co… |
| 2026-05-07 | kbtoys.com.au | +61 295250878. We offer a wide selection of toys and giftware that wou… |
| 2026-05-03 | emtco.com | +1 3169426147 . Engineered Machine Tool, Inc., based in Wichita, Kansa… |
| 2026-05-03 | it-freitag.de | +49 493526000000 . Freitag IT GmbH specializes in providing scalable a… |
| 2026-05-03 | manateeair.com | +1 9417582323 . Manatee Air Heating & Cooling Inc has been providing e… |
| 2026-04-29 | boxtopia.co.uk | +44 1476576090 . Boxtopia is the UK's leading supplier of custom cardb… |
| 2026-04-28 | osoftec.com | +91 9717385459 . Optimization Software Technologies, LLP. is an advanc… |
| 2026-04-26 | dmschweiz.ch | Sie haben im Katalog unsere Angebote von installierten und betriebsber… |
| 2026-04-26 | anvilarts.org.uk | Anvil Arts is the largest performing arts organization in Hampshire, o… |
| 2026-04-26 | primeproperties.com.au | Prime Properties (NSW) P/L is a privately owned company based in Sydne… |
| 2026-04-26 | airdriephysio.com | Airdrie Physiotherapy & Massage is a multi-disciplinary clinic located… |
| 2026-04-26 | rainforestclean.com | Rainforest Carwash and Oil Change, along with it’s owner, enjoys givin… |
| 2026-04-23 | rotak.it |
CONFIRMED ATTACKS
M3rx confirmed attacks: 1 verified incident
Ransomnews has verified 1 M3rx incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in August 2026. Spain accounts for 1 of them (100%). The most affected sector is technology, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified M3rx incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Tecnologías de Código Abierto S.L. (Tecnoabi) | Technology | Malaga, Spain | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from M3rx's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.