Close Menu
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) Instagram Threads
Ransomnews
  • Home
  • News
  • Security
  • Privacy
  • Cybercrime
    • Threat Groups
    • Ransomware
    • Explainers
    • Stealer Logs
  • AI
  • OSINT
  • Tools
    • Ransomtracker
    • Stealercheck
    • FortiBleed Checker
  • About Us
Facebook X (Twitter) LinkedIn
Ransomnews

RALORD · Threat actor profile

// THREAT ACTOR

RALORD_

Dormant

RALORD is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of RALORD — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

21 Victims tracked
0 / 4 Active mirrors
2025-03-25 First listing
2025-04-27 Most recent

Victims by year

  • 2025 21

Leak site mirrors

4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

  • ralordqe33mpufkpsr6zkdatktlu3t2uei4ught3sitxgtzfmqmbsuyd.onion New upgrade for Brand snapshot · 2026-08-06 12:02
  • ralord3htj7v2dkavss2hjzviviwgsf4anfdnihn5qcjl6eb5if3cuqd.onion New upgrade for Brand snapshot · 2026-08-06 17:51
  • ralordt7gywtkkkkq2suldao6mpibsb7cpjvdfezpzwgltyj2laiuuid.onion New upgrade for Brand snapshot · 2026-08-06 19:00
  • novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onion Nova Panel | Login snapshot · 2025-07-11 21:03

Recent victims

The 50 most recent victims claimed by RALORD. Total in the index: 21.

Date listed Victim Description
2025-04-27 DIALLOG company Diallog Telecommunications is a Canadian-owned and operated telecom co…
2025-04-24 HELUKABEL company The website www.helukabel.de is the official online presence of HELUKA…
2025-04-23 rawafid company Established in 2008 and headquartered in Riyadh, Rawafid Industrial sp…
2025-04-22 ​​​​agromate company Agromate.com.my is the official website of Agromate Holdings Sdn Bhd, …
2025-04-19 ​​​​bettininformatica - suporteon company ​​​​​​​​BThe website bettininformatica.com.br belongs to Bettin Soluçõ…
2025-04-16 ​​​​Bio-Clima Service ​​​​​​​​Bio-Clima Service Srl, an Italian company based in Bernareggio…
2025-04-15 ARRCO LSM ARRCO – Lights Sound Magic is a professional event technology company …
2025-04-15 NewHotel cloud company ​​​​Newhotel Cloud is a comprehensive, cloud-based Property Management…
2025-04-15 Al-Hejailan Group Established in 1980, the Al-Hejailan Group began as an engineering and…
2025-04-10 hasbco Company ​​​​​​​​​​​Hasbco is a company that operates in the Grocery Retail ind…
2025-04-10 hasbco ​​​​​​​​​​​Hasbco is a company that operates in the Grocery Retail ind…
2025-03-31 Tomio Ingeniería ​​Tomio Ingeniería S.A. is an Argentine company specializing in engine…
2025-03-31 Élan Sportif Nantes ​​​The domain ec-nantes.fr is associated with École Centrale de Nantes…
2025-03-31 Ihara company ​​​​​IHARA is a Brazilian company specializing in the development and …
2025-03-31 Pere Claver grup ​​​​​​​​Pere Claver Grup is a private, non-profit organization establi…
2025-03-30 Formosa Chang ​​​​​​​​​​​Formosa Chang is a well-known Taiwanese restaurant chain, p…
2025-03-28 pereclaver.org ​​​​​​​​Pere Claver Grup is a private, non-profit organization establi…
2025-03-27 ihara.com.br ​​​​​IHARA is a Brazilian company specializing in the development and …
2025-03-25 semaphore.asso.fr
2025-03-25 ec-nantes.fr ​The domain ec-nantes.fr is associated with École Centrale de Nantes, …
2025-03-25 tomioingenieria.com.ar ​​Tomio Ingeniería S.A. is an Argentine company specializing in engine…

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.

Facebook X (Twitter) LinkedIn
© 2026 Ransomnews.com

Type above and press Enter to search. Press Esc to cancel.

Cookies on Ransomnews

We use strictly-necessary cookies to run the site and may use first-party analytics to understand which articles are read. Some pages contain affiliate links — when you click one, the affiliate network sets cookies on the merchant's domain to attribute the referral. See the Cookie Policy and Affiliate Disclosure for detail.

RANSOMNEWS.COM

Tracking the criminal infrastructure of the internet.

Independent coverage of ransomware, breach economics, threat actors, privacy, AI security, and the open-source investigation toolkit.

// Topics

  • News
  • Security
  • Privacy
  • Cybercrime
  • AI
  • OSINT
  • Threat Groups
  • Stealer Logs
  • Ransomtracker
  • Stealercheck
  • FortiBleed Checker

// Site

  • About Us
  • Editorial Team
  • Contact
  • Tip Line
  • Editorial

// Legal

  • Privacy Policy
  • Terms of Service
  • Cookie Policy
  • Funding & Independence
  • RSS Feed
© 2026 Ransomnews.com · Tracking the criminal infrastructure of the internet.