THREAT ACTOR
METAENCRYPTOR_
DormantMETAENCRYPTOR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of METAENCRYPTOR, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 1
- 2025 7
- 2024 11
- 2023 17
Leak site mirrors
2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
metacrptmytukkj7ajwjovdpjqzd7esg5v3sg344uzhigagpezcqlpyd.onionMetaencryptor::Home snapshot · 2026-09-23 01:00 -
metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onionMetaencryptor::Home snapshot · 2026-09-23 00:27
Recent victims
The 50 most recent victims claimed by METAENCRYPTOR. Total in the index: 36.
| Date listed | Victim | Description |
|---|---|---|
| 2026-03-04 | MPA Pharma GmbH | MPA Pharma GmbH is an internationally active, rapidly growing company … |
| 2025-10-30 | Weber Water Resources | Founded in 1910, Weber Water Resources has been providing the widest r… |
| 2025-09-15 | Trailer Transit Inc | Nationwide power-only transport services with 40+ years of experience.… |
| 2025-08-25 | Woodlore International Inc. | Woodlore is manufacturer specializes in laminate casegood production f… |
| 2025-06-24 | The Lowell Hotel New York | The Lowell is a New York legacy and a landmark luxury hotel, located n… |
| 2025-06-05 | Groupe Devimco | As a leader in real estate development in Quebec, Groupe Devimco has b… |
| 2025-04-08 | Third Avenue Management | |
| 2025-01-27 | Lee Hartman & Sons | Lee Hartman & Sons, Inc., provides design, engineering, installation, … |
| 2024-08-22 | Saeilo | Saeilo is a diversified manufacturing company consisting of three oper… |
| 2024-08-22 | Life University | Life University is a private university Leading Chiropractic and Holis… |
| 2024-08-15 | MBS Radio | MBS Radio is a locally owned and operated group of 24 radio stations a… |
| 2024-07-31 | Carlex Glass Luxembourg S.A. | Carlex Glass Luxembourg SA in Grevenmacher is a part of Webasto, the w… |
| 2024-06-14 | MBE CPA | MBE CPA is accounting service and business services company, provide f… |
| 2024-05-07 | Dillon supply | Established in 1914, Dillon Supply distributes industrial products. Th… |
| 2024-05-07 | Autohaus Ebert | Autohaus Ebert GmbH & Co.KG has been there for its customers for more … |
| 2024-05-07 | Elbers GmbH & Co. KG | Wholesale and retail trade, import and export of flowers, plants, vege… |
| 2024-05-07 | Jetson Specialty Marketing Services, Inc. | JSM is a full-service direct marketing communications company steadfas… |
| 2024-05-07 | Vega Reederei GmbH & Co. KG | Headquartered at the Port of Hamburg, Vega is one of the world's faste… |
| 2024-05-07 | Max Wild GmbH | Max Wild GmbH, based in Berkheim, has been responsible for the profess… |
| 2023-12-07 | stormtech | stormtech |
| 2023-12-07 | Garda | Garda |
| 2023-11-28 | JD Sprinter Holdings 2010 SL | JD Sprinter Holdings 2010 SL retails sportswear, outdoor clothing, and… |
| 2023-11-01 | TANATEX Chemicals | TANATEX Chemicals is an international organisation that sells, develop… |
| 2023-09-29 | Belzona UK Ltd | Specialising in erosion, corrosion and chemical protection, Belzona is… |
| 2023-08-17 | Dillon Supply | Established in 1914, Dillon Supply distributes industrial products. Th… |
| 2023-08-17 | Epicure | Epicure is a online shop with healthy eating. The company is primarily… |
| 2023-08-17 | Coswell | The Company Coswell is an italian family run group of companies specia… |
| 2023-08-17 | BOB Automotive Group | Die BOB Automotive Group mit Hauptsitz in Essen ist eine Holding für r… |
| 2023-08-17 | Seoul Semiconductor | Seoul Semiconductor is the top LED manufacturing company in Korea and … |
| 2023-08-17 | Kraiburg Austria GmbH | Kraiburg Austria GmbH Lösungen für die Reifenrunderneuerung Bei KRAI… |
| 2023-08-17 | Autohaus Ebert GmbH | Autohaus Ebert GmbH & Co.KG has been there for its customers for more … |
| 2023-08-17 | CVO Antwerpen | Education for adults. Revenue: $72M |
| 2023-08-17 | ICON Creative Studio | ICON Creative Studio is Canada’s largest independently owned CG Animat… |
| 2023-08-17 | Heilmann Gruppe | Heilmann Gruppe The purchase and sale of potatoes and onions, as well … |
| 2023-08-17 | Schwälbchen Molkerei AG | Schwälbchen Molkerei AG is a company that operates in the Consumer Ser… |
| 2023-08-17 | Münchner Verlagsgruppe GmbH | Münchner Verlagsgruppe GmbH is a company that operates in the Publishi… |
CONFIRMED ATTACKS
MetaEncryptor confirmed attacks: 12 verified incidents
Ransomnews has verified 12 MetaEncryptor incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from April 2023 to August 2026. Germany accounts for 5 of them (42%), with victims recorded in 5 countries in total. The most affected sector is retail, at 3 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 11. Where a figure was disclosed (5 cases), these incidents account for 78,351 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified MetaEncryptor incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Corona Corporation | Manufacturing | Niigata, Japan | 35,000 | Unknown | Source |
| September 2025 | Trailer Transit Inc. | Transportation | Indiana, United States | 257 | Unknown | Source |
| August 2024 | Saeilo Enterprises, Inc. | Manufacturing | Massachusetts, United States | 8,725 | Unknown | Source |
| July 2024 | Life University | Education | Georgia, United States | 3,389 | Unknown | Source |
| April 2024 | MBE CPAs | Finance | Wisconsin, United States | 30,980 | Unknown | Source |
| April 2024 | Max Wild GmbH | Construction | Berkheim, Germany | — | Unknown | Source |
| March 2024 | EUROFLEURS - Elbers GmbH & Co. KG | Retail | Kevalaer, Germany | — | Unknown | Source |
| November 2023 | Sprinter | Retail | Alicante, Spain | — | Unknown | Source |
| August 2023 | Autohaus Ebert GmbH & Co. KG | Retail | Bensheim, Germany | — | Unknown | Source |
| August 2023 | Münchner Verlagsgruppe GmbH | Service | Munich, Germany | — | Unknown | Source |
| June 2023 | Schwälbchen Molkerei Jakob Berz AG | Food and Beverage | Bad Schwalbach, Germany | — | No | Source |
| April 2023 | CVO Antwerpen | Education | Antwerp, Belgium | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from MetaEncryptor's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.