THREAT ACTOR
RANSOMEXX_
ActiveRANSOMEXX is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of RANSOMEXX, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
76
Victims tracked
1 / 4
Active mirrors
2021-09-09
First listing
2026-06-20
Most recent
Victims by year
- 2026 3
- 2025 4
- 2024 13
- 2023 8
- 2022 20
- 2021 28
Leak site mirrors
4 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onionRansomEXX v2 snapshot · 2026-09-22 22:03 -
zubllg7o774lgc4rdxmfcfpjewfkqa7ml7gxwl5fetogc7hbkvaprhid.onionsnapshot · 2025-11-01 06:08 -
jbdg4buq6jd7ed3rd6cynqtq5abttuekjnxqrqyvk4xam5i7ld33jvqd.onionsnapshot · 2026-02-28 17:24 -
rbx2hfyej6sogivjtw2z2xkcqwgtiy653ap5jylggsrj6glbmfr7axqd.onion403 Forbidden snapshot · 2026-09-23 05:25
Recent victims
The 50 most recent victims claimed by RANSOMEXX. Total in the index: 76.
| Date listed | Victim | Description |
|---|---|---|
| 2026-06-20 | Go2Joy (go2joy.vn) | We have released the complete database of Go2Joy, Vietnam’s leading pl… |
| 2026-04-17 | SOGO Auction | SOGO Auction - 951MB leaked. SOGO Auction is a prominent Japan-based, … |
| 2026-04-16 | GoTip | GoTip - 1.13GB leaked. Gotip.jp is a Japanese live-streaming enhanceme… |
| 2025-03-09 | Grupo Vargas | Laboratorios Vargas stands out in the pharmaceutical sector, not just … |
| 2025-03-09 | ADDA (adda.io) | ADDA is SaaS for Residential Community Management. 12 millions residen… |
| 2025-02-09 | Makesworth Accountants | Makesworth Accountants is multi-award-winning accountancy practice of … |
| 2025-02-03 | Lakeshore Title Agency | Date: Fri 31 January 2025 Tags: #usa Lakeshore Title Agency has cl… |
| 2024-09-14 | Retemex | Retemex is a virtual mobile operator in Mexico, operating on the count… |
| 2024-08-10 | Brontoo Technology Solutions | OstaApp, developed by Brontoo Technology Solutions India Private Limit… |
| 2024-08-03 | nursing.com | NURSING.com is an all-in-one online platform designed to help nursing … |
| 2024-07-26 | Planet Group International | Planet Group International is a multinational corporation specializing… |
| 2024-07-26 | LITEON | LITEON Technology Corporation, based in Taiwan, is a leading company i… |
| 2024-07-12 | Wagner-Meinert | Wagner-Meinert is a company that specializes in industrial refrigerati… |
| 2024-07-01 | TUV Rheinland AG | Post will be available soon… Leaked data size: 650GB. |
| 2024-04-17 | Asteco | Asteco is a real estate services firm based in the United Arab Emirate… |
| 2024-03-26 | Badan Urusan Logistik | BULOG, or Badan Urusan Logistik, is the state-owned logistics agency o… |
| 2024-03-26 | Jacobs Farm / Del Cabo | Jacobs Farm / Del Cabo is an organic farming company known for its com… |
| 2024-03-26 | DVision Architecture | Dvision Architecture is a global architecture and design firm known fo… |
| 2024-03-26 | Telecommunications Services of Trinidad and Tobago | Telecommunications Services of Trinidad and Tobago (TSTT) is the prima… |
| 2024-03-26 | Ministry of Defense of Peru | The Peruvian Ministry of Defense (Ministerio de Defensa del Perú) is t… |
| 2023-12-30 | Kenya Airways | Kenya Airways Ltd., more commonly known as Kenya Airways, is the flag … |
| 2023-11-26 | AlJaber Engineering | AlJaber Engineering (JEC) is a leading general contractor based in the… |
| 2023-11-16 | Admilla ELAP | Elap (formerly Admilia) offers its expertise and support throughout th… |
| 2023-10-27 | Telecommunications Services of Trinidad and Tobago (tstt.co.tt) | tstt.co.tt and bmobile.co.tt. 4293368 customer's lines, ID scans, gitl… |
| 2023-07-01 | DVA - DVision Architecture | Dalla digitalizzazione del progetto alla realizzazione di prototipi co… |
| 2023-06-24 | Jacobs Farm | Jacobs Farm was founded in 1980 as a small organic family farm dedicat… |
| 2023-03-02 | Bettuzzi And Partners | Lo Studio BETTUZZI & PARTNERS - Dottori Commercialisti è stato fondato… |
| 2023-02-22 | BULOG | BULOG adalah perusahaan umum milik negara yang bergerak di bidang logi… |
| 2022-12-11 | REC Silicon | REC Silicon is a global leader in silane-based, high-purity silicon ma… |
| 2022-10-18 | Unimed Belem | A Unimed é a maior realidade cooperativista na área da saúde em todo o… |
| 2022-10-11 | Consorci Sanitari Integral & Geseme | El Consorci Sanitari Integral (CSI) és un ens públic de serveis sanita… |
| 2022-10-03 | Ferrari | Some internal documents, datasheets, repair manuals, etc. |
| 2022-10-01 | Bombardier Recreational Products (BRP) - SOURCE CODES | Here are some codes from BRP's repos. atgk.brp.ApprenticeShopAPI, atgk… |
| 2022-09-03 | Fundo Nacional de Desenvolvimento da Educação | The National Fund for Educational Development (FNDE) is a federal agen… |
| 2022-08-24 | Bombardier Recreational Products (BRP) - BONUS CONTENT (!!!) | In addition to previous leak: employees credentials, if you need netfl… |
| 2022-08-23 | Bombardier Recreational Products (BRP) | BRP Inc. is the holding company for Bombardier Recreational Products I… |
| 2022-08-18 | Corporación Nacional de Telecomunicación | |
| 2022-08-18 | Liberty Group & ForHousing | ForHousing formerly City West Housing Trust (CWHT) is a housing associ… |
| 2022-08-18 | Hellmann Worldwide Logistics | Hellmann Worldwide Logistics is one of the largest international logis… |
| 2022-08-18 | Scottish Association for Mental Health | SAMH is the leading mental health organisation in the voluntary sector… |
| 2022-04-05 | WT Microelectronics | |
| 2022-04-05 | Sonae | Food Retail Market Leader in Portugal |
| 2022-03-29 | Stago | Diagnostica Stago, Inc., (DSI) is an industry leader in the science of… |
| 2022-03-20 | Scottish Association for Mental Health | |
| 2022-03-15 | Viva Air | Fast Colombia S.A.S., trading as Viva Air Colombia and formerly VivaCo… |
| 2022-02-15 | Samvardhana Motherson Peguform | |
| 2022-02-15 | POP TV | Pro Plus is a Slovenian multimedia company (d.o.o.) for television man… |
| 2022-01-28 | KCA Deutag | With over 130 years of experience, KCA Deutag is a leading drilling, e… |
| 2021-12-15 | Ajuntament de Castelló | |
| 2021-12-15 | Hellmann Worldwide Logistics |
CONFIRMED ATTACKS
Ransomexx confirmed attacks: 35 verified incidents
Ransomnews has verified 35 Ransomexx incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2020 to July 2024. Brazil accounts for 5 of them (14%), with victims recorded in 19 countries in total. The most affected sector is manufacturing, at 7 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 5; the outcome is unrecorded in the remaining 29. Where a figure was disclosed (3 cases), these incidents account for 6,045 exposed records.
35Verified incidents
19Countries
2020–2024Active range
17%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Ransomexx incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2024 | TÜV Rheinland Akademie GmbH | Education | Berlin, Germany | — | Unknown | Source |
| July 2024 | C-Edge Technologies Limited (Brontoo Technology Solutions India Private Limited) | Finance | Thane, India | — | Unknown | Source |
| July 2024 | LITEON Technology Corporation | Manufacturing | Taipei, Taiwan | — | Unknown | Source |
| December 2023 | Kenya Airways | Transportation | Nairobi, Kenya | — | Unknown | Source |
| November 2023 | Élap (Admilia) | Technology | Brignoles, France | — | Unknown | Source |
| October 2023 | Telecommunications Service of TT (TSTT) | Utilities | Port of Spain, Trinidad and Tobago | — | No | Source |
| December 2022 | REC Silicon ASA | Manufacturing | Lysaker, Norway | — | Unknown | Source |
| October 2022 | Unimed Belém | Finance | Belém, Brazil | — | Unknown | Source |
| October 2022 | Consorci Sanitari Integral (CSI) | Healthcare | Barcelona, Spain | — | Unknown | Source |
| September 2022 | Fundo Nacional de Desenvolvimento da Educação (FNDE) | Government | Brasília, Brazil | — | Unknown | Source |
| August 2022 | Bombardier Recreational Products (BRP) | Manufacturing | Montreal, Canada | — | Unknown | Source |
| April 2022 | SONAE | Other | Maia, Portugal | — | Unknown | Source |
| March 2022 | Scottish Association for Mental Health (SAMH) | Healthcare | Glasgow, United Kingdom | — | Unknown | Source |
| December 2021 | Hellmann Worldwide Logistics | Transportation | Osnabrück, Germany | — | Unknown | Source |
| August 2021 | GIGABYTE | Manufacturing | Taipei, Taiwan | — | Unknown | Source |
| August 2021 | Ermenegildo Zegna Holding | Other | Milan, Italy | — | Unknown | Source |
| July 2021 | ForHousing and Liberty (Part of ForViva) | Other | Eccles, United Kingdom | — | Unknown | Source |
| July 2021 | Corporación Nacional de Telecomunicación (CNT) | Government | Quito, Ecuador | — | No | Source |
| June 2021 | Universal Assistance S.A. | Finance | Buenos Aires, Argentina | — | Unknown | Source |
| May 2021 | Stemcor | Service | London, United Kingdom | — | Unknown | Source |
| March 2021 | Pertamina EP | Utilities | Jakarta, Indonesia | — | Unknown | Source |
| March 2021 | Ayuntamiento de Castellón | Government | Castellón, Spain | 3,733 | No | Source |
| February 2021 | Soluzioni Infrastrutturali Telefoniche ed Elettriche (Sittel) | Utilities | Rome, Italy | — | Unknown | Source |
| February 2021 | Mutuelle Nationale des Hospitaliers (MNH) | Healthcare | Amilly, France | — | Unknown | Source |
| February 2021 | CalAmp, Corp | Technology | California, United States | — | Unknown | Source |
| January 2021 | Ultrapar Participações S.A. (Grupo Ultra) | Utilities | São Paulo, Brazil | — | Unknown | Source |
| December 2020 | Inchcape Australia | Retail | Baulkham Hills, Australia | — | Unknown | Source |
| December 2020 | Groupe Atlantic | Manufacturing | La Roche-sur-Yon, France | — | Unknown | Source |
| November 2020 | Embraer | Manufacturing | São Paulo, Brazil | — | No | Source |
| November 2020 | Superior Tribunal de Justiça (STJ) | Government | Brasilia, Brazil | — | Unknown | Source |
| October 2020 | Montreal's Société de Transport de Montréal (STM) | Government | Montreal, Canada | — | No | Source |
| September 2020 | Tyler Technologies | Technology | Texas, United States | 2,301 | Yes | Source |
| September 2020 | IPG Photonics | Manufacturing | Massachusetts, United States | 11 | Unknown | Source |
| July 2020 | Konica Minolta | Technology | Tokyo, Japan | — | Unknown | Source |
| May 2020 | Texas Department of Transportation (TxDOT) | Government | Texas, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Ransomexx's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.