THREAT ACTOR
PEAR_
ActivePEAR is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of PEAR, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
137
Victims tracked
5 / 25
Active mirrors
2025-08-06
First listing
2026-11-05
Most recent
Victims by year
- 2026 86
- 2025 51
Leak site mirrors
25 mirrors tracked, 5 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
peargxn3oki34c4savcbcfqofjjwjnnyrlrbszfv6ujlx36mhrh57did.onionPEAR snapshot · 2026-11-15 19:00 -
yxwomyfmexm3bfcuumnugrzwluol5qwsw6pmne7jklgmzthkp35l2jqd.onion403 Forbidden snapshot · 2026-11-15 10:01 -
pearsmob5sn44ismokiusuld34pnfwi6ctgin3qbvonpoob4lh3rmtqd.onionPEAR snapshot · 2026-11-15 21:01 -
etus2tmakckdlkyjpevoyciuao7er5fj3qm26aev3nch4fusptefiayd.onion403 Forbidden snapshot · 2026-11-14 18:04 -
csxilwnl7orv6rwfjen5ye3tefk5shjtr4tysuykgxjsyngpvoqrvbid.onion403 Forbidden snapshot · 2026-11-15 00:00 -
xq5m6ofel63h57by46algju25g37zkdwoxxt7ij45b6obo4mxzc3h6id.onion403 Forbidden snapshot · 2026-11-15 18:02 -
q2bg7ljsrpmy6736qqmpwsnqqm3w6d3hhrokohytnmldbom7sthp4sad.onion403 Forbidden snapshot · 2026-11-15 18:02 -
psvrn6ahevi6dgf55bzc26q3gjc7s6n7vcth34rmkl2y7e7dijhjfiqd.onion403 Forbidden snapshot · 2026-10-04 21:00 -
5qynbyjl4u6vbtnmpokslaxaknyicdvty7vn2qgxmaty3lb7wwxpkbid.onion403 Forbidden snapshot · 2026-11-14 10:03 -
diyr2bnty7iktyxfd4kz65uigcfappjvux73dpgkkeocp3fmlgnuzyyd.onion403 Forbidden snapshot · 2026-11-14 23:00 -
e7a6zgqfijn2ko6lzkz53tysjpnf22fxj4h2f3saufrmsts5pbul5eid.onion403 Forbidden snapshot · 2026-11-15 17:00 -
m3wwhkus4dxbnxbtihexlyd2cv63qrvex6jiebc4vqe22kg2z3udebid.onion403 Forbidden snapshot · 2026-10-04 21:00 -
xsomiaq5awxh3zkzn334s3dgwuvngy6z2to7265exgovnkwk66hjypid.onion403 Forbidden snapshot · 2026-10-04 19:00 -
3hzi7qjklm632atxj5k67p3bxdie5aipvf6tsbtc2xlfbcellujyxryd.onion403 Forbidden snapshot · 2026-11-15 15:02 -
smnalvhqecyjf7reptunoevh6jd6x7ofpz4tj2plyg5a4q667givgqyd.onion403 Forbidden snapshot · 2026-11-15 21:01 -
njqaowdto3tfbbco575fkmhahszxfw7fiprbfmt6y6kfy5fntt45akyd.onion403 Forbidden snapshot · 2026-11-15 21:01 -
zvacnemrrluposfmwgp4bqvb34ipoorgh7yyqoozu6gcmh5z32wjgsad.onion403 Forbidden snapshot · 2026-11-15 13:00 -
wu22mxmkgd4hgs7j3x7aqurgzhwzy3gf5qpwngpobpnet4i6myebutyd.onion403 Forbidden snapshot · 2026-11-14 18:00 -
shtobqdovtbat7fvnoq6lqwi3rqirel6l2r6sqxiidfq5g33tqms6kyd.onion403 Forbidden snapshot · 2026-11-15 13:01 -
na2remb2imblbjqrrl3ct4jixmqu3per3wm66hobt3ngtfwx3lv56uqd.onion403 Forbidden snapshot · 2026-11-15 15:00 -
prhcul4q3pixstzhmvot4wexadj7b6cpi7ifu5efxz55vjggmms6xvqd.onion403 Forbidden snapshot · 2026-11-13 17:00 -
ydyjmi3hiq7givwvlcfftct2mwhfwurycl67suwnu7fj6tvkl3gl77yd.onion403 Forbidden snapshot · 2026-11-15 21:02 -
glheoet37vdimgho57tqj76v7fnebnbqxn65bounxyt6hduilkso4yyd.onion403 Forbidden snapshot · 2026-11-15 15:00 -
aw6wb6lmqbtp5po7qrmvmujulbxw4eeeolpg3byva2bgoj44psdugmid.onion403 Forbidden snapshot · 2026-11-15 21:00 -
757ylxaeemidrhrmmuz6rkxw5jlk65oqou3lvi6evxtrr2nhm5ytmrqd.onion403 Forbidden snapshot · 2026-11-15 18:01
Recent victims
The 50 most recent victims claimed by PEAR. Total in the index: 137.
| Date listed | Victim | Description |
|---|---|---|
| 2026-11-05 | Bridgestone HosePower, LLC | A distributor for Flextral Hydraulic Hose and Industrial Hose Products |
| 2026-11-04 | gWorks | A technology company specializing in software solutions designed to he… |
| 2026-11-04 | Palm Vascular Centers | A company specializing in collaboration with interventional radiologis… |
| 2026-11-02 | Neiman & Company, Inc. | Architectural signage for clients including hotels, corporate offices,… |
| 2026-10-30 | Five Star Jewelers | Premier jewelry store located in Miami, FL |
| 2026-10-28 | Cyrious Software | Specialized business management software designed for sign, graphics, … |
| 2026-10-23 | Fresh Farms | Offers a wide range of top-quality products that meet the needs of cus… |
| 2026-10-21 | Adobe Insurance Brokers, LLC | Independent insurance agency located in Morgan Hill, California |
| 2026-10-16 | Macfarlan Capital Partners | Equity real estate investment sponsor that serves institutional invest… |
| 2026-10-16 | Solar Communications International | Prominent supplier and developer of RFTransparent products that seamle… |
| 2026-10-16 | Caretaker Landscape and Tree Management | Full-service commercial landscape and development services such as pru… |
| 2026-10-01 | Software Answers, a Banyan Software Company | Software company serving the long-term stay accommodation industry, in… |
| 2026-09-28 | Kellys Home Center | The company specializes in selling high-quality home appliances, mattr… |
| 2026-09-24 | Westside GI | Ambulatory endoscopy center |
| 2026-09-24 | Martin Lawrence Galleries | Premier gallery of fine art in America |
| 2026-09-24 | Indroj Medical Group Inc. | The Web's Free NPI Registry Search & Provider Reference Site |
| 2026-09-11 | Foss Inc. | Leading provider of installation, maintenance services to the energy i… |
| 2026-09-04 | Kovo Healthtech Corp | Versatile technology company leading the Charge in AI process automati… |
| 2026-09-03 | EdgeChem Jamaica Limited | Manufacture Automotive, Industrial, Decorative and Furniture Coatings,… |
| 2026-09-02 | Next Level Medical, LLC | Affordable urgent care across Texas |
| 2026-08-27 | NEXT LEVEL MEDICAL, LLC | Affordable urgent care across Texas |
| 2026-08-22 | Island Networks | Provider for Business-class Internet, Cybersecurity & Home Wi-Fi |
| 2026-08-22 | Mogren, Glessner & Ahrens, P.S. | Services in family law |
| 2026-08-21 | Clifton Architectural Glass & Metal | A company that installs double-pane windows |
| 2026-08-21 | First Commerce LLC | Privately held real estate investment and development company |
| 2026-08-20 | Medical Arts Chemists and Surgicals | Prescriptions and Home Medical Equipment |
| 2026-08-20 | Club One Casino | A Place to Play Cards in Central California |
| 2026-08-20 | Practi-Cal | Comprehensive platform to manage Medi-Cal billing, LEA BOP, and CRCS s… |
| 2026-08-20 | Austin Plastic Surgery Institute | A center staffed by highly skilled plastic surgeons |
| 2026-07-30 | Sonitor Technologies | Sonitor’s platform and technologies deliver the accurate and reliable … |
| 2026-07-24 | Metropolitan Construction Systems | Leading commercial roofing company based in New York City |
| 2026-07-15 | Carient Heart & Vascular | Expert resource for heart and vascular care in Northern Virginia |
| 2026-07-15 | South Plains Rural Health Services, Inc. | Comprehensive and family care in West Texas |
| 2026-07-13 | Faro Products Inc. | Leading manufacturer in the promotional products and souvenir |
| 2026-07-08 | Tostrud & Temp, S.C. | Full service CPA firm serving La Crosse |
| 2026-07-03 | AC Beverage, Inc. | Provider in the draft beer service industry, specializing in the insta… |
| 2026-07-03 | CNW Electronics Pte Ltd | Providing complete wire harness solutions, from design to manufacturin… |
| 2026-06-30 | Spector and Lenz, PC | Firm provides legal representation to clients facing disability, injur… |
| 2026-06-30 | ORA Group Information | Specializing in retail and the point-of-sale experience |
| 2026-06-30 | Sociedad Latina | Support in education, civic engagement, workforce development, and art… |
| 2026-06-19 | Optimum First Mortgage | Providing fast and reliable mortgage solutions, including home purchas… |
| 2026-06-18 | B & B Trading | Largest independent food wholesale distributors in New England |
| 2026-06-18 | Release Marine, Inc. | Handmade sport fishing equipment and yacht furnishings |
| 2026-06-18 | Kirbor Homes | Kirbor Homes is a reputable home builder located in the Mid-Atlantic r… |
| 2026-06-10 | K & E Distributing | |
| 2026-06-10 | Bayou Electrical Services | |
| 2026-06-10 | National Health Fund | |
| 2026-06-10 | Alpha IT | |
| 2026-05-30 | Plexsupply Inc | A private wholesale and distribution company offering the highest-qual… |
| 2026-05-20 | Pro Farm Group Inc | Experts at discovering, developing, and commercializing naturally deri… |
CONFIRMED ATTACKS
Pear confirmed attacks: 24 verified incidents
Ransomnews has verified 24 Pear incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2025 to September 2026. United States accounts for 22 of them (92%), with victims recorded in 2 countries in total. The most affected sector is healthcare, at 12 confirmed victims. Where a figure was disclosed (13 cases), these incidents account for 2,663,143 exposed records.
24Verified incidents
2Countries
2025–2026Active range
—Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Pear incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| September 2026 | EdgeChem Jamaica Limited | Manufacturing | Kingston, Jamaica | — | Unknown | Source |
| July 2026 | Next Level Medical, LLC | Healthcare | Texas, United States | 501 | Unknown | Source |
| June 2026 | Carient Heart and Vascular LLC | Healthcare | Virginia, United States | — | Unknown | Source |
| June 2026 | National Health Fund | Government | Kingston, Jamaica | — | Unknown | Source |
| April 2026 | Colonial Presbyterian Church | Other | Missouri, United States | 10,536 | Unknown | Source |
| April 2026 | Arkansas Oral and Maxillofacial Surgeons | Healthcare | Arkansas, United States | — | Unknown | Source |
| April 2026 | Beyond Measure Design & Construction | Construction | Florida, United States | — | Unknown | Source |
| April 2026 | Morning Star Tours | Other | Texas, United States | 18,997 | Unknown | Source |
| February 2026 | Monmouth University | Education | New Jersey, United States | 164,041 | Unknown | Source |
| October 2025 | Rocky Mountain Associated Physicians | Healthcare | Utah, United States | 50,640 | Unknown | Source |
| October 2025 | Riddell Law Group | Legal | Florida, United States | 19,596 | Unknown | Source |
| October 2025 | Medical Center, LLP | Healthcare | Georgia, United States | — | Unknown | Source |
| September 2025 | MCBS, LLC | Healthcare | Georgia, United States | 1,261,464 | Unknown | Source |
| September 2025 | Western Orthopaedics, P.C. | Healthcare | Colorado, United States | 113,330 | Unknown | Source |
| September 2025 | Brevard Skin and Cancer Center | Healthcare | Florida, United States | 55,500 | Unknown | Source |
| September 2025 | Tri-Century Eye Care, P.C. | Healthcare | Pennsylvania, United States | 200,000 | Unknown | Source |
| September 2025 | Dubroff, Easley & Lovell, LLP | Legal | California, United States | — | Unknown | Source |
| August 2025 | VirMedice, LLC | Healthcare | Arizona, United States | 1,000 | Unknown | Source |
| August 2025 | Motility Software Solutions | Technology | Florida, United States | 766,670 | Unknown | Source |
| August 2025 | West Chester Township | Government | Ohio, United States | — | Unknown | Source |
| July 2025 | U.S. Graphite Corporation | Manufacturing | Michigan, United States | 868 | Unknown | Source |
| June 2025 | Expert MRI | Healthcare | California, United States | — | Unknown | Source |
| June 2025 | The Job Shop | Service | California, United States | — | Unknown | Source |
| June 2025 | Think Big Health Care Solutions | Healthcare | Florida, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Pear's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.