THREAT ACTOR
MORPHEUS_
ActiveMORPHEUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of MORPHEUS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 12
- 2025 12
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
izsp6ipui4ctgxfugbgtu65kzefrucltyfpbxplmfybl5swiadpljmyd.onionMORPHEUS (contact [email protected]) snapshot · 2026-09-23 05:21
Recent victims
The 50 most recent victims claimed by MORPHEUS. Total in the index: 24.
| Date listed | Victim | Description |
|---|---|---|
| 2026-07-30 | Yue Ki Industrial | Website: yueki.com.tw Revenue: $21 Million Yue Ki Industrial is a manu… |
| 2026-07-22 | Kyowa Singapore Pte Ltd | Website: kyowasingapore.com Revenue: $15 Million Founded in 1979 and h… |
| 2026-07-06 | Hansa Research Group Pvt. Ltd | Website: hansaresearch.com Revenue: $22 Million Hansa Research is a gl… |
| 2026-06-25 | Delegal Poindexter & Underkofler, P.A. | Website: protectingcareers.com Revenue: $5 Million Delegal Poindexter … |
| 2026-06-10 | HDFC FUND | Website: hdfcfund.com Revenue: $427.8 Million HDFC Asset Management Co… |
| 2026-06-08 | 3I INFOTECH | Website: 3i-infotech.com Revenue: $96.8 Million 3i Infotech, incorpora… |
| 2026-05-14 | BAYTECH A/S | Website: baytech.dk Revenue: $5 Million Baytech A/S is a Danish indust… |
| 2026-04-21 | GGI | Website: ggitokiomarine.com Website: ggipinsurance.com Revenue: $19.2 … |
| 2026-03-30 | SBCTANZANIA | Website: sbctanzania.co.tz Revenue: $42.5 Million SBC Tanzania Limited… |
| 2026-03-20 | SURTECHINC | Website: surtechinc.kr Revenue: $5 Million Company is a leader in the … |
| 2026-03-20 | New publication | |
| 2026-01-29 | SUNSETWORLDRESORTS | Website: sunsetworldresorts.com Revenue: $593 Million Sunset World Gro… |
| 2025-12-27 | VALLEREDONDO | Website: valleredondo.com.mx Revenue: $50 Million Family owned, founde… |
| 2025-12-22 | TEAMGLOBAL | Website: teamglobal.com Revenue: $6.3 Million Premier contract and di… |
| 2025-12-22 | SCIPIONI | Website: scipioni.be Revenue: $5 Million Scipioni is a company special… |
| 2025-11-20 | Teamglobal | Website: teamglobal.com Revenue: $6.3 Million Premier contract and di… |
| 2025-05-20 | Landmark Properties | Website: landmarkproperties.com Revenue: $1.5 Billion Landmark Propert… |
| 2025-04-07 | Latronica Law Firm, P.C | Website: latronicalaw.com Revenue: $5 Million The Latronica Law is a f… |
| 2025-04-07 | Metal Sales Manufacturing Corporation | Website: metalsales.us.com Revenue: $270.1 Million Metal Sales is the… |
| 2025-04-01 | Alora Pharmaceuticals, LLC | Website: alorapharma.com acellapharma.com avionrx.com osmotica.com sov… |
| 2025-02-25 | Dinizulu Law Group LTD | Website: dinizululawgroup.com Revenue: $5 Million Dinizulu Law Group, … |
| 2025-01-17 | LYNXSPA | Website: lynxspa.com Revenue: $292.5 Million Lynx, the Partner for Dig… |
| 2025-01-07 | Arrotex Pharmaceuticals | Website: https://dbghealth.com.au/arrotex/ Revenue: $92 Million The ex… |
| 2025-01-07 | Pus Gmbh | Website: pus-gmbh.eu Revenue: $5 Million The P&S GmbH & Co. KG has spe… |
CONFIRMED ATTACKS
Morpheus confirmed attacks: 4 verified incidents
Ransomnews has verified 4 Morpheus incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2024 to May 2026. India accounts for 2 of them (50%), with victims recorded in 3 countries in total. The most affected sector is finance, at 2 confirmed victims.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Morpheus incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| May 2026 | 3i Infotech Ltd | Technology | Navi Mumbai, India | — | Unknown | Source |
| May 2026 | HDFC Asset Management Company | Finance | Mumbai, India | — | Unknown | Source |
| April 2026 | GGI Tokio Marine Insurance | Finance | Yangon, Myanmar | — | Unknown | Source |
| August 2024 | DBG Global Enterprises Pty Ltd (DBG Health) | Healthcare | Cremorne, Australia | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Morpheus's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.