// THREAT ACTOR
MONTI_
DormantMONTI is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of MONTI — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 20
- 2024 45
- 2023 45
- 2022 2
Leak site mirrors
21 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
4s4lnfeujzo67fy2jebz2dxskez2gsqj2jeb35m75ktufxensdicqxad.onion404 Not Found snapshot · 2022-10-10 22:12 -
mblogci3rudehaagbryjznltdp33ojwzkq6hn2pckvjq33rycmzczpid.onionMONTI - Leaks site snapshot · 2025-05-17 09:47 -
fzuaswymt34cbkneudijgqrzkalrgpsyfbo6uuodoeifwiqf3cwqscid.onionsnapshot · 2024-11-19 17:18 -
oiatmncwdk6jnavutic5zusl4sttwschx7nicvqykluyckekex3zqaad.onionsnapshot · 2024-11-19 17:19 -
jblxfrssnygh7bsoyict5wccgahvqp6tauncixr3y3dxypidiqy4tjyd.onionsnapshot · 2024-11-19 17:20 -
egtqjenfxq7g6sqnjknww3tsnlutzqlq747cf73ni3xsfxzqqz2f5qad.onionsnapshot · 2024-11-19 17:21 -
edaus74qljecooagcvcg67quldd2hwokkr5zqj5jtdeuidgjoesvwdad.onionIndex of / snapshot · 2024-12-15 19:20 -
gchf5ohuxo36metdnt3hfdz6m4up3pmv6t6m63llvldtnh57guwnp4qd.onionApache2 Ubuntu Default Page: It works snapshot · 2025-05-24 06:06 -
363zyixg32bdudpakmd4n4bclbprcqrkyvdssv6yamozfurodktss2qd.onionIndex of / snapshot · 2024-12-20 07:01 -
trqm74keteqm7jdathr2fgljf5tdhtifocoii4inmdu66ekpaotihvyd.onionIndex of / snapshot · 2024-12-29 08:07 -
usmrktigxirv2qvpkwjr5n3pxz5hpsucffzujuo7e6f3y6se7uiqzwyd.onionIndex of / snapshot · 2025-05-21 06:03 -
bvxhv3zfewf5jx4gcrsxrwbuwmjggffxjyv42vwj6b6u2clmgchxtfid.onionIndex of / snapshot · 2025-05-30 05:02 -
drfxoorlgu5n4c4uhnfli7saprnl2p46i36duhyehmfp7ysn44e3quid.onionIndex of / snapshot · 2024-12-28 08:12 -
t4h4hbkrrbrrfkbf6luhnewykjr52gkdmgfr6hbeeub5t2rcyhb4buad.onionIndex of / snapshot · 2025-05-19 05:38 -
yyn3h2lnr5joqebus5syb2p3fzdms7avulvsn3m3gsdvwtgu2ow5c6ad.onionIndex of / snapshot · 2025-05-19 05:00 -
v4httzsp6ri6xcw7lpmdduvhce5avtla3yocfru5suxpgcgo7rw7slyd.onionIndex of / snapshot · 2025-05-19 05:09 -
myosbja7hixkkjqihsjh6yvmqplz62gr3r4isctjjtu2vm5jg6hsv2ad.onionServer Error snapshot · 2025-08-04 14:26 -
qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onionsnapshot · 2024-12-11 09:14 -
monti5o7lvyrpyk26lqofnfvajtyqruwatlfaazgm3zskt3xiktudwid.onionsnapshot · 2025-08-04 14:09 -
il6jcce6f5htppc3smu4olpt5pz3akdg5h7k7tb4n45jixxu2o2oxlid.onionsnapshot · 2025-05-26 13:16 -
cls2wzky5vxgu54fg4fqdj4q4olyvmwt6rinmtgqsq5d3vubv7bdzgqd.onionDirectory listing for / snapshot · 2025-03-15 20:00
Recent victims
The 50 most recent victims claimed by MONTI. Total in the index: 112.
| Date listed | Victim | Description |
|---|---|---|
| 2025-05-10 | American Eagle Logistics - Full Leak | www.aeagleoilfield.com |
| 2025-05-07 | Amtech Software | Enterprise Resource Planning (ERP) Software |
| 2025-05-03 | American Eagle Logistics - Press Release | www.aeagleoilfield.com |
| 2025-03-19 | CD | Full Leak |
| 2025-03-19 | Gloria Cales | Full leak |
| 2025-03-06 | agi.net | Architecture, Engineering & Design / Virginia, United States / 800 Emp… |
| 2025-03-04 | 365labs - Security Corp | Full leak |
| 2025-03-04 | Phoenix | Full leak |
| 2025-03-02 | FM.GOB.AR | Full leak |
| 2025-02-12 | Omni Fiber LLC | Full database |
| 2025-02-11 | sole technology | full leak |
| 2025-01-31 | ibericar | Full Leak |
| 2025-01-30 | nenok.de | Full leak |
| 2025-01-30 | FENSTERMAKER | Full leak |
| 2025-01-29 | SCV Med Group | Full leak |
| 2025-01-28 | lnetwork | full leak |
| 2025-01-28 | Acoustiblok | Household Goods |
| 2025-01-28 | BBLAWFIRM | Lawyers |
| 2025-01-28 | metalurgica roma | full leak |
| 2025-01-22 | Omni Fiber LLC - Press Release | Full database |
| 2024-12-22 | ibericar - Press Release | Auto Suckers |
| 2024-11-26 | Publications postponded | ... |
| 2024-11-20 | Oxford Auto Insurance | Insurance |
| 2024-11-19 | Anderson Miller LTD | Hospitality |
| 2024-11-19 | Premier Tax Services | Accounting Services |
| 2024-11-19 | KVF | Industrial Machinery & Equipment |
| 2024-11-19 | Southern Oregon Veterinary Specialty Center | Healthcare Services |
| 2024-10-21 | La Tazza D'oro - Full Leak | Hospitality · Italy |
| 2024-10-21 | Burgess Kilpatrick - Full Leak | Accounting Services |
| 2024-10-21 | Welding and Fabrication (Humble Mfg) - Full Leak | Building Materials |
| 2024-10-21 | Phyton Biotech - Full Leak | Business Services |
| 2024-10-21 | Cotala Cross-Media - Full Leak | Business Services |
| 2024-10-21 | City Projects - Full Leak | Canada |
| 2024-10-21 | Raeyco Lab Equipment - Full Leak | Office Products Retail & Distribution |
| 2024-10-21 | Seng Tsoi Architect - Full Leak | Architecture, Engineering & Design |
| 2024-10-07 | Richmond Auto Mall - Full Leak | Automobile Dealers |
| 2024-10-04 | City Of Forest Park - Full Leak | Georgia, United States |
| 2024-09-03 | bluemaven.ca problems | additional information |
| 2024-08-30 | Burgess Kilpartik | Burgess Kilpatrick is an accounting and professional services firm loc… |
| 2024-08-30 | Richmond Auto Mall | Automobile Dealers |
| 2024-08-30 | Seng Tsoi Architect | Architecture, Engineering & Design |
| 2024-08-30 | Raeyco Lab Equipment Systems Management | Office Products Retail & Distribution |
| 2024-08-30 | Welding and Fabrication (humblemfg) | Building Materials |
| 2024-08-30 | City Projects | Commercial & Residential Construction |
| 2024-08-30 | Prism Construction | Commercial & Residential Construction |
| 2024-08-30 | Cotala Cross-Media | Business Services |
| 2024-08-30 | Phyton Biotech | Business Services |
| 2024-08-26 | Blue Maven Group - Press Release | Blue Maven provides extensive IT Procurement services. |
| 2024-08-01 | Adorna & Guzman Dentistry | Dental |
| 2024-07-24 | forestparkga.gov | City & PD |
// CONFIRMED ATTACKS
Monti confirmed attacks: 17 verified incidents
Ransomnews has verified 17 Monti incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2023 to March 2025. United States accounts for 9 of them (53%), with victims recorded in 6 countries in total. The most affected sector is education, at 6 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 2; the outcome is unrecorded in the remaining 15. Where a figure was disclosed (8 cases), these incidents account for 606,578 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Monti incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2025 | Amtech Software, Inc. | Technology | Pennsylvania, United States | 5,077 | Unknown | Source |
| February 2025 | Architectural Graphics, Inc. (AGI) | Manufacturing | Virginia, United States | 2,907 | Unknown | Source |
| November 2024 | Bergen auf Rügen | Government | Bergen auf Rügen, Germany | — | No | Source |
| November 2024 | Southern Oregon Veterinary Specialty Center | Healthcare | Oregon, United States | — | Unknown | Source |
| July 2024 | City of Forest Park | Government | Georgia, United States | — | Unknown | Source |
| June 2024 | Excelsior Orthopaedics | Healthcare | New York, United States | 394,752 | Unknown | Source |
| May 2024 | Wayne Memorial Hospital | Healthcare | Georgia, United States | 163,440 | Unknown | Source |
| May 2024 | Éklore Ed Sport Business | Education | Pau, France | — | Unknown | Source |
| May 2024 | Esc Pau Etudes Conseils | Education | Pau, France | — | Unknown | Source |
| May 2024 | Pau Pyrenees Airport | Transportation | Pau, France | — | Unknown | Source |
| September 2023 | University of Defence | Education | Brno, Czechia | — | Unknown | Source |
| September 2023 | Univerzita Obrany | Education | Brno-střed, Czechia | — | Unknown | Source |
| September 2023 | Auckland University of Technology | Education | Auckland, New Zealand | — | Unknown | Source |
| July 2023 | Siden & Associates, P.C. | Legal | Massachusetts, United States | 605 | Unknown | Source |
| April 2023 | ASL 1 - Avezzano Sulmona L'Aquila | Healthcare | L'Aquila, Italy | 6,800 | No | Source |
| March 2023 | Regional Transportation Authority of Northeastern Illinois | Government | Illinois, United States | 2,629 | Unknown | Source |
| February 2023 | Cambridge College | Education | Massachusetts, United States | 30,368 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Monti's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.