THREAT ACTOR
RALORD_
ActiveRALORD is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of RALORD, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 21
Leak site mirrors
4 mirrors tracked, 2 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
ralordqe33mpufkpsr6zkdatktlu3t2uei4ught3sitxgtzfmqmbsuyd.onionNew upgrade for Brand snapshot · 2026-09-23 02:18 -
ralord3htj7v2dkavss2hjzviviwgsf4anfdnihn5qcjl6eb5if3cuqd.onionNew upgrade for Brand snapshot · 2026-09-23 05:36 -
ralordt7gywtkkkkq2suldao6mpibsb7cpjvdfezpzwgltyj2laiuuid.onionNew upgrade for Brand snapshot · 2026-09-23 05:33 -
novazzitmugtbjwuttc5hhsemkmvwh3iyt27oeeunu5mkw62qpfeykid.onionNova Panel | Login snapshot · 2025-07-11 21:03
Recent victims
The 50 most recent victims claimed by RALORD. Total in the index: 21.
| Date listed | Victim | Description |
|---|---|---|
| 2025-04-27 | DIALLOG company | Diallog Telecommunications is a Canadian-owned and operated telecom co… |
| 2025-04-24 | HELUKABEL company | The website www.helukabel.de is the official online presence of HELUKA… |
| 2025-04-23 | rawafid company | Established in 2008 and headquartered in Riyadh, Rawafid Industrial sp… |
| 2025-04-22 | agromate company | Agromate.com.my is the official website of Agromate Holdings Sdn Bhd, … |
| 2025-04-19 | bettininformatica - suporteon company | BThe website bettininformatica.com.br belongs to Bettin Soluçõ… |
| 2025-04-16 | Bio-Clima Service | Bio-Clima Service Srl, an Italian company based in Bernareggio… |
| 2025-04-15 | ARRCO LSM | ARRCO – Lights Sound Magic is a professional event technology company … |
| 2025-04-15 | NewHotel cloud company | Newhotel Cloud is a comprehensive, cloud-based Property Management… |
| 2025-04-15 | Al-Hejailan Group | Established in 1980, the Al-Hejailan Group began as an engineering and… |
| 2025-04-10 | hasbco Company | Hasbco is a company that operates in the Grocery Retail ind… |
| 2025-04-10 | hasbco | Hasbco is a company that operates in the Grocery Retail ind… |
| 2025-03-31 | Tomio Ingeniería | Tomio Ingeniería S.A. is an Argentine company specializing in engine… |
| 2025-03-31 | Élan Sportif Nantes | The domain ec-nantes.fr is associated with École Centrale de Nantes… |
| 2025-03-31 | Ihara company | IHARA is a Brazilian company specializing in the development and … |
| 2025-03-31 | Pere Claver grup | Pere Claver Grup is a private, non-profit organization establi… |
| 2025-03-30 | Formosa Chang | Formosa Chang is a well-known Taiwanese restaurant chain, p… |
| 2025-03-28 | pereclaver.org | Pere Claver Grup is a private, non-profit organization establi… |
| 2025-03-27 | ihara.com.br | IHARA is a Brazilian company specializing in the development and … |
| 2025-03-25 | semaphore.asso.fr | |
| 2025-03-25 | ec-nantes.fr | The domain ec-nantes.fr is associated with École Centrale de Nantes, … |
| 2025-03-25 | tomioingenieria.com.ar | Tomio Ingeniería S.A. is an Argentine company specializing in engine… |
CONFIRMED ATTACKS
Ralord confirmed attacks: 13 verified incidents
Ransomnews has verified 13 Ralord incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2025 to June 2026. France accounts for 2 of them (15%), with victims recorded in 11 countries in total. The most affected sector is education, at 5 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 3; the outcome is unrecorded in the remaining 9. Where a figure was disclosed (2 cases), these incidents account for 941,180 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Ralord incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2026 | NSW Rural Fire Service | Government | Sydney, Australia | — | Unknown | Source |
| June 2026 | Aspire Hospitals | Healthcare | Odisha, India | — | Unknown | Source |
| May 2026 | Wyższa Szkoła Biznesu - National Louis University | Education | Nowy Sącz, Poland | — | Unknown | Source |
| May 2026 | LTI Services and Larick Towing Inc. | Transportation | New Jersey, United States | — | Unknown | Source |
| May 2026 | Universitat de València | Education | València, Spain | — | No | Source |
| December 2025 | L'Epi du Rouergue | Food and Beverage | La Loubière, France | — | Unknown | Source |
| October 2025 | Regency Specialist Hospital | Healthcare | Johor Bahru, Malaysia | — | Unknown | Source |
| July 2025 | Clinical Diagnostics (Eurofins) | Healthcare | Rijswijk, Netherlands | 941,000 | Yes | Source |
| July 2025 | Ensemble Montplaisir | Education | Valence, France | — | Unknown | Source |
| June 2025 | Feng Chia University | Education | Taichung, Taiwan | — | Unknown | Source |
| May 2025 | Sun Moon University | Education | Asan, South Korea | — | No | Source |
| May 2025 | Comune di Pisa | Government | Pisa, Italy | — | No | Source |
| March 2025 | Pere Claver Grup | Healthcare | Barcelona, Spain | 180 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Ralord's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.