THREAT ACTOR
MAD-LIBERATOR_
DormantMAD-LIBERATOR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of MAD-LIBERATOR, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2024 14
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onionMADDLL32 - LEAKED FILES snapshot · 2024-10-03 13:06
Recent victims
The 50 most recent victims claimed by MAD-LIBERATOR. Total in the index: 14.
| Date listed | Victim | Description |
|---|---|---|
| 2024-10-01 | marthamedeiros.com.br | Martha Medeiros e uma estilista apaixonada que transformou a renda fei… |
| 2024-09-06 | ctelift.com | Since 1981 CTE has been creating solutions to make working at height e… |
| 2024-09-04 | ych.com | Founded in 1955 by the late Mr Yap Chwee Hock, YCH began as a modest p… |
| 2024-08-17 | awsag.com | We have more than 20 years of experience in consulting and engineering… |
| 2024-08-07 | suandco.com | Suandco tiene su origen en el despacho fundado en 1951 por Don Francis… |
| 2024-08-02 | coinbv.nl | COIN is your hands-on partner for IT Continuity, Disaster & Workplace … |
| 2024-07-24 | orbinox.com | ORBINOX was founded in Tolosa in 1964, manufacturing industrial valves… |
| 2024-07-24 | vrd.be | VRD is een modern transportbedrijf waarbij kwaliteit, flexibiliteit en… |
| 2024-07-16 | VITALDENT.COM | Vitaldent is a dental company founded in 1989. Today, it has more than… |
| 2024-07-16 | BENICULTURALI.IT | Il Ministero per i Beni Culturali e Ambientali fu istituito da Giovann… |
| 2024-07-16 | msprocuradores.es | Segura Procuradores SLP es una sociedad profesional, dedicada al ejerc… |
| 2024-07-16 | crosswear.co.uk | Crosswear has been trading since 1972 and business has evolved to beco… |
| 2024-07-16 | sacities.net | Our vision and mission is crucial to the work we do. Integral to the S… |
| 2024-07-16 | zb.co.zw | In 1972, the company changed its name from The Netherlands Bank of Rho… |
CONFIRMED ATTACKS
Mad Liberator confirmed attacks: 3 verified incidents
Ransomnews has verified 3 Mad Liberator incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2024 to July 2024. Zimbabwe accounts for 1 of them (33%), with victims recorded in 3 countries in total. The most affected sector is government, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Mad Liberator incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2024 | ZB Financial Holdings Limited | Finance | Harare, Zimbabwe | — | Unknown | Source |
| July 2024 | VitalDent | Healthcare | Madrid, Spain | — | Unknown | Source |
| May 2024 | Direzione Generale Educazione e Ricerca del Ministero della Cultura (MiC) | Government | Rome, Italy | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Mad Liberator's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.