// THREAT ACTOR

PROMETHEUS_

Dormant

PROMETHEUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of PROMETHEUS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

0 Victims tracked

0 / 2 Active mirrors

— First listing

— Most recent

Leak site mirrors

2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

promethw27cbrcot.onion snapshot · 2021-09-08 00:07
promethw27cbrcot.onion snapshot · 2024-12-10 05:34

// CONFIRMED ATTACKS

Prometheus confirmed attacks: 18 verified incidents

Ransomnews has verified 18 Prometheus incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2021 to June 2021. Brazil accounts for 7 of them (39%), with victims recorded in 9 countries in total. The most affected sector is finance, at 3 confirmed victims.

18Verified incidents

9Countries

2021–2021Active range

—Paid, where outcome known

Confirmed victims by year

202118

Most affected sectors

Finance3
Manufacturing3
Healthcare2
Service2
Retail2
Food and Beverage2
Other1
Government1

Most affected countries

Brazil7
United States3
France2
Mexico1
Chile1
Ghana1
Netherlands1
Austria1

Verified Prometheus incidents

Date	Organisation	Sector	Location	Records	Ransom paid	Source
June 2021	Master Publicidade Ltda	Service	Curitiba, Brazil	—	Unknown	Source
June 2021	Sincor-SP	Finance	São Paulo, Brazil	—	Unknown	Source
June 2021	Chilli Beans	Retail	São Paulo, Brazil	—	Unknown	Source
June 2021	A-1 Machine Manufacturing Inc	Manufacturing	California, United States	—	Unknown	Source
May 2021	Tulsa Cardiovascular Center of Excellence	Healthcare	Oklahoma, United States	—	Unknown	Source
May 2021	Vendrig Holding B.V.	Service	Utrecht, Netherlands	—	Unknown	Source
May 2021	Hotel Nyack	Other	New York, United States	—	Unknown	Source
May 2021	Gobierno de México	Government	Mexico City, Mexico	—	Unknown	Source
May 2021	Despretz	Construction	Beaugency, France	—	Unknown	Source
May 2021	Paraty Capital (TMF Group)	Finance	Pinheiros, Brazil	—	Unknown	Source
May 2021	Agricola Cerro Prieto	Food and Beverage	Santa Rosa, Peru	—	Unknown	Source
May 2021	Arca Assurances	Finance	Reims, France	—	Unknown	Source
April 2021	Sprink	Retail	Rio de Janeiro, Brazil	—	Unknown	Source
April 2021	Metalgráfica Cearense	Manufacturing	Fortaleza, Brazil	—	Unknown	Source
April 2021	Medicar	Healthcare	Ribeirão Preto, Brazil	—	Unknown	Source
April 2021	Dinkhauser Kartonagen	Manufacturing	Tirol, Austria	—	Unknown	Source
April 2021	Coca-Cola Embonor	Food and Beverage	Las Condes, Chile	—	Unknown	Source
March 2021	Ghana National Gas	Utilities	Accra, Ghana	—	Unknown	Source

Claimed vs confirmed. The figures above the fold on this page come from Prometheus's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.