THREAT ACTOR
RANSOMHUB_
DormantRansomHub is a ransomware-as-a-service operation that surfaced in early 2024 and quickly absorbed displaced affiliates from disbanded groups including ALPHV/BlackCat and LockBit. It became one of the most prolific groups by claimed-victim count within months of launching, hitting healthcare, manufacturing, and government targets.
For Ransomnews editorial coverage of RANSOMHUB, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
868
Victims tracked
0 / 46
Active mirrors
2024-02-10
First listing
2025-04-01
Most recent
Victims by year
- 2025 236
- 2024 632
Leak site mirrors
46 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onionRansomHub | Home snapshot · 2025-04-02 07:00 -
mjmru3yz65o5szsp4rmkmh4adlezcpy5tqjjc4y5z6lozk3nnz2da2ad.onionIndex of / snapshot · 2024-05-09 17:21 -
an2ce4pqpf2ipvba2djurxi5pnxxhu3uo7ackul6eafcundqtly7bhid.onionsnapshot · 2024-06-17 23:10 -
fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onionIndex of / snapshot · 2024-08-03 14:00 -
xeuvs5poflczn5i5kbynb5rupmidb5zjuza6gaq22uqsdp3jvkjkciqd.onionsnapshot · 2025-03-25 20:14 -
7vy5mydtkf4hqo3g5s4v7skmyn2xdh4mxg3xgtcqnequuospqtsmutqd.onionsnapshot · 2024-12-10 15:53 -
crylcxzmkllsvq3qgh6gmeg3abqcyliepqza2r57o43gsfwomibq2cyd.onionsnapshot · 2024-12-10 15:53 -
qa5qvqhtuzlyzrrgc7dkepyj34hb4psf6hk7jmiyn6cef7fxajdleoid.onionsnapshot · 2024-12-10 15:53 -
ransombgegc4e2vuq45noxekkmauikzt7qu6ab2rqsthdyxdpdufbqid.onionRansomHub | File Upload snapshot · 2025-04-01 18:00 -
ransomgxjnwmu5ceqwo2jrjssxpoicolmgismfpnslaixg3pgpe5qcad.onionsnapshot · 2024-12-10 15:54 -
shedjytnmsdgyey7ho7r52leod3plffhe3yjmhyxfxxivnunnmw7coid.onionsnapshot · 2024-12-10 15:54 -
vqcrizmr7757hjbamfcb7pei2zv462o4ypi2djj4xvy5ax7f2b3c7bad.onionsnapshot · 2024-12-10 15:54 -
davtdavm734bl4hkr3sr4dvfzpdzuzei2zrcor4vte4a3xuok2rxcmyd.onionsnapshot · 2024-12-10 22:33 -
dd4djzr2ywfcox3zfvpkpyh3b657hsdwpwv5cfkmdfde2lr3fpz6spad.onionsnapshot · 2024-12-10 22:34 -
cki3klxqycazagx3r5prae3nmfvxmwa34beknr3il4uf76vxd76akqid.onionsnapshot · 2024-12-10 22:34 -
pod4gkypkd6kykwoht3kioehhpoh4k75ybdfoe6q7hqbphrd77b32jqd.onionsnapshot · 2024-12-10 22:34 -
445ouvbxlevrxm7phyfr4au3ritat62zl7cwvrarvonrwmququordayd.onionRansomHub - Login snapshot · 2025-02-11 08:32 -
nr4jw2reeta2u4n2sq4sejjudllir4yfotzf5d4p3wn2ep6ddomtxxid.onionsnapshot · 2024-12-12 11:45 -
m52fl4estv4lmcvqhssh7mb7nsygiwe7oybhjhny7iuzrzwulq455eqd.onionsnapshot · 2024-12-12 11:46 -
brclvwefzszko5xrlan7pebyliqdkv5cw75xksrxp772urjytkko5fyd.onionsnapshot · 2024-12-12 12:55 -
rmr2kgq6vzifnyoaz7jaxdx5t6gsxurbakah5bafatsqldtt2mwneyid.onionRansomHub - Login snapshot · 2025-01-09 21:05 -
xdg53hbpwshgtbfbm6m7nv3ckkduo3dfdwdearcsvybfb3qaf4v7suyd.onionRansomHub - Login snapshot · 2024-12-27 16:04 -
toq7bk6abkr6lapwj3k22ffu4ud5jpox7jbfgzetpz7lxb427katstid.onionsnapshot · 2024-12-12 16:50 -
tjnt7x2xodhthwrfnabhloogoo66jrgohgzpta22uwbqznsvrm5tu4id.onionRansomHub - Login snapshot · 2025-03-05 17:02 -
fvixrjsdk2adazfnz4mrdvr4eznm346fk33y7nos65bdrtmfvw7f5vid.onionRansomHub - Login snapshot · 2025-03-02 18:12 -
vhxbjx4iaeqgna22kqt5ajlqi72vbm6qcjev3efgr5oiklgptvjvjhqd.onionRansomHub - Login snapshot · 2025-03-17 06:14 -
yszafmehxkoa7hrcay7cnyogfrmjqc4grds6innadspii5oz6fneyzyd.onionRansomHub - Login snapshot · 2025-03-05 20:00 -
i4xita2momkw2jitqohbqgomjxqp53pyvgv5gbogvendbx3ucnynekyd.onionRansomHub - Login snapshot · 2025-03-08 22:05 -
3ysbtsnhldlijvfdv7hwkr2gl3op2d56puspeo4whs6p272sde6fq5id.onionsnapshot · 2025-02-20 17:14 -
bd3atkmicmcif6mliquqdxltjq6mxvagw44gealayp34awtcx3ywlxid.onion404 Not Found snapshot · 2026-05-09 14:00
Recent victims
The 50 most recent victims claimed by RANSOMHUB. Total in the index: 868.
| Date listed | Victim | Description |
|---|---|---|
| 2025-04-01 | europtec.com | |
| 2025-04-01 | delta-life.com | |
| 2025-04-01 | intellioan.com | |
| 2025-04-01 | jackpotjunction.com | |
| 2025-03-29 | www.assisi.nl | |
| 2025-03-28 | phaus.us&phakr.com&phabodysystems.com | |
| 2025-03-28 | www.bassi.it | |
| 2025-03-27 | www.allmilmoe.com | |
| 2025-03-27 | brattenelectrictn.com | |
| 2025-03-26 | www.hongthongrice.com | |
| 2025-03-26 | www.fkm-elemente.de | |
| 2025-03-26 | conterra.com | |
| 2025-03-26 | www.DSelectrical.com | |
| 2025-03-25 | www.carolinaac.com | |
| 2025-03-25 | www.garbinc.com | |
| 2025-03-25 | www.mododoc.com | |
| 2025-03-25 | www.argentosc.com | |
| 2025-03-25 | www.ripplejunction.com | |
| 2025-03-25 | www.creativelogisticservices.com | |
| 2025-03-25 | www.afnigc.ca | |
| 2025-03-25 | www.cormidom.com.do | |
| 2025-03-25 | www.lions-online.org | |
| 2025-03-24 | www.solidworld.it | |
| 2025-03-24 | www.s3s.com | |
| 2025-03-24 | www.rivaldt.com | |
| 2025-03-24 | OMLTD.CO.JP | |
| 2025-03-24 | technicare.com | |
| 2025-03-24 | cisd.org | |
| 2025-03-24 | mnm.hu | |
| 2025-03-24 | texascompressionservices.com | |
| 2025-03-24 | www.solventacentroamerica.com | |
| 2025-03-24 | www.exemplar.com | |
| 2025-03-21 | gbsn.com.br | |
| 2025-03-21 | www.sinkdirect.com | |
| 2025-03-21 | www.broadmoormethodist.org | |
| 2025-03-21 | www.parklandmanufacturing.com | |
| 2025-03-21 | www.solinst.com | |
| 2025-03-21 | www.allstarhealthcaresolutions.com | |
| 2025-03-21 | www.njcalwe.com | |
| 2025-03-21 | www.gcsnet.com | |
| 2025-03-21 | www.core-1.com | |
| 2025-03-21 | www.esquirebrands.com | |
| 2025-03-21 | www.avalonapparel.com | |
| 2025-03-21 | www.oneupinnovations.com | |
| 2025-03-21 | www.scpautomation.com | |
| 2025-03-21 | www.gestionquintessence.com | |
| 2025-03-21 | www.engines.man.eu | |
| 2025-03-21 | www.abmenviro.ca | |
| 2025-03-21 | www.accessfinanceonline.com | |
| 2025-03-21 | www.ahmadiyya.ca |
CONFIRMED ATTACKS
RansomHub confirmed attacks: 166 verified incidents
Ransomnews has verified 166 RansomHub incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from February 2024 to March 2025. United States accounts for 90 of them (54%), with victims recorded in 36 countries in total. The most affected sector is government, at 31 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 23; the outcome is unrecorded in the remaining 143. Where a figure was disclosed (70 cases), these incidents account for 7,127,907 exposed records.
166Verified incidents
36Countries
2024–2025Active range
0%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified RansomHub incidents (100 most recent of 166)
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| March 2025 | Southern Regional Medical Group | Healthcare | Albany, Australia | — | Unknown | Source |
| March 2025 | Intelliloan | Finance | California, United States | 389 | Unknown | Source |
| March 2025 | Conterra Ultra Broadband Holdings, Inc. d/b/a Conterra Networks | Utilities | North Carolina, United States | 1,497 | Unknown | Source |
| March 2025 | Baxter Laboratories Pty Ltd | Healthcare | Boronia, Australia | — | Unknown | Source |
| March 2025 | Jackpot Junction Casino Hotel (Lower Sioux Indian Community) | Government | Minnesota, United States | — | Unknown | Source |
| February 2025 | Portland Public Schools | Education | Maine, United States | 12,128 | Unknown | Source |
| February 2025 | Blake Jones Law Firm LLC | Legal | Louisiana, United States | 2,117 | Unknown | Source |
| February 2025 | ENCON Heating & Air Conditioning | Service | Connecticut, United States | 1,408 | Unknown | Source |
| February 2025 | The LoveSac Company | Manufacturing | Connecticut, United States | 1,840 | Unknown | Source |
| February 2025 | Diller Scofidio + Renfro, LLC | Service | New York, United States | — | Unknown | Source |
| February 2025 | All Star Healthcare Solutions (All Star Recruiting Locums, LLC) | Healthcare | Florida, United States | 4,498 | Unknown | Source |
| February 2025 | Alpha Wellness and Alpha Medical Centre | Healthcare | Georgia, United States | 1,714 | Unknown | Source |
| February 2025 | Family Christian Health Center | Healthcare | Illinois, United States | 12,500 | Unknown | Source |
| February 2025 | Keystone Pacific Property Management | Service | California, United States | 402 | Unknown | Source |
| February 2025 | Eliza Jennings Senior Care Network | Healthcare | Ohio, United States | 845 | Unknown | Source |
| February 2025 | Bay Village of Sarasota | Healthcare | Florida, United States | 1,405 | Unknown | Source |
| February 2025 | JPW Industries, Inc. | Manufacturing | Tennessee, United States | 1,440 | Unknown | Source |
| February 2025 | Whitman Hospital & Medical Clinics | Healthcare | Washington, United States | 63,453 | No | Source |
| February 2025 | Magyar Nemzeti Múzeum - Nemzeti Régészeti Intézet | Government | Budapest, Hungary | — | Unknown | Source |
| February 2025 | Access Financial Services, Ltd. | Finance | Kingston, Jamaica | — | Unknown | Source |
| February 2025 | Raymond Limited | Manufacturing | Mumbai, India | — | Unknown | Source |
| February 2025 | Riverdale Country School | Education | New York, United States | 1,524 | No | Source |
| February 2025 | Town of Hinton | Government | Hinton, Canada | — | Unknown | Source |
| February 2025 | Leki Aviation | Retail | Kastrup, Denmark | — | Unknown | Source |
| February 2025 | O-M Ltd. | Manufacturing | Osaka, Japan | — | Unknown | Source |
| February 2025 | Hudson Gavin Martin | Legal | Auckland, New Zealand | — | Unknown | Source |
| February 2025 | ELECGALAPAGOS S.A. | Government | Galápagos, Ecuador | — | Unknown | Source |
| February 2025 | Transcend Information, Inc. | Manufacturing | Taipei, Taiwan | — | Unknown | Source |
| February 2025 | Sault Ste. Marie Tribe of Chippewa Indians | Government | Michigan, United States | — | No | Source |
| February 2025 | City of Tarrant | Government | Alabama, United States | — | No | Source |
| January 2025 | Smith-Midland Corporation | Manufacturing | Virginia, United States | — | Unknown | Source |
| January 2025 | Georgia Heritage Federal Credit Union | Finance | Georgia, United States | 43,077 | Unknown | Source |
| January 2025 | WEL Companies, Inc. | Transportation | Wisconsin, United States | 122,960 | Unknown | Source |
| January 2025 | Heartland Recreational Vehicles | Retail | Indiana, United States | 25,185 | Unknown | Source |
| January 2025 | Digestive Disease Specialists, Inc. | Healthcare | Oklahoma, United States | — | Unknown | Source |
| January 2025 | SDK FREJA | Transportation | Taastrup, Denmark | — | Unknown | Source |
| January 2025 | Town of Bourne | Government | Massachusetts, United States | — | No | Source |
| January 2025 | A.Y. McDonald Mfg. Co. | Manufacturing | Iowa, United States | 2,210 | Unknown | Source |
| January 2025 | EuroCert | Technology | Warsaw, Poland | — | Unknown | Source |
| January 2025 | SportAdmin | Technology | Malmö, Sweden | — | Unknown | Source |
| January 2025 | South African Weather Service | Government | Pretoria, South Africa | — | No | Source |
| December 2024 | Manpower of Lansing, MI Inc. | Service | Michigan, United States | 144,189 | Unknown | Source |
| December 2024 | League Education & Treatment Center | Healthcare | New York, United States | 825 | Unknown | Source |
| December 2024 | Sunsweet Growers, Inc. | Food and Beverage | California, United States | — | Unknown | Source |
| December 2024 | Miedema Produce Inc. | Food and Beverage | Michigan, United States | 2,328 | Unknown | Source |
| December 2024 | Bis Industries Limited | Service | North Sydney, Australia | — | Unknown | Source |
| December 2024 | Primal Wear, Inc. | Manufacturing | Colorado, United States | — | Unknown | Source |
| December 2024 | Wong Fleming | Legal | New Jersey, United States | 1,234 | Unknown | Source |
| December 2024 | American Plumbing & Heating Corporation | Construction | Massachusetts, United States | 962 | Unknown | Source |
| December 2024 | Mission Bank | Finance | California, United States | — | Unknown | Source |
| December 2024 | Community Health Northwest Florida (CHNWF) | Healthcare | Florida, United States | — | Unknown | Source |
| December 2024 | Fondo Genesis | Finance | Quito, Ecuador | — | Unknown | Source |
| December 2024 | PSC Corporation Ltd | Food and Beverage | Singapore, Singapore | — | Unknown | Source |
| December 2024 | Scania Polska SA | Retail | Nadarzyn, Poland | — | Unknown | Source |
| December 2024 | Wayne-Westland Community Schools | Education | Michigan, United States | — | Unknown | Source |
| December 2024 | Highland Park Independent School District | Education | Texas, United States | 6,935 | Unknown | Source |
| December 2024 | Marietta City Schools | Education | Georgia, United States | — | Unknown | Source |
| November 2024 | 3C Care Systems, LLC | Healthcare | Minnesota, United States | 108,487 | Unknown | Source |
| November 2024 | Williams Scarborough Gray, LLP | Finance | North Carolina, United States | 973 | Unknown | Source |
| November 2024 | The Sporn Company d/b/a Perrywinkle's Fine Jewelry | Retail | Vermont, United States | 374 | Unknown | Source |
| November 2024 | Greenscape Land Design Inc. | Service | Massachusetts, United States | 2,860 | Unknown | Source |
| November 2024 | Troxler Electronic Laboratories, Inc. | Manufacturing | North Carolina, United States | 520 | Unknown | Source |
| November 2024 | Wirral University Teaching Hospital NHS Trust | Healthcare | Wirral, United Kingdom | — | Unknown | Source |
| November 2024 | Bologna FC | Other | Bologna, Italy | — | No | Source |
| November 2024 | Refinadora Costarricense de Petróleo (Recope) | Government | Barranca, Costa Rica | — | No | Source |
| November 2024 | Instituto Nacional de Investigación de Tecnología Agraria y Alimentaria (INIA-CSIC) | Government | Madrid, Spain | — | Unknown | Source |
| November 2024 | Minneapolis Park Recreation Board | Government | Minnesota, United States | — | Unknown | Source |
| November 2024 | Gobierno de México | Government | Mexico City, Mexico | — | Unknown | Source |
| November 2024 | FDC Accountants & Tax Consultants Limited | Finance | Cork, Ireland | — | Unknown | Source |
| October 2024 | Sundance Holdings Group, LLC (Sundance Living) | Retail | Utah, United States | 576 | Unknown | Source |
| October 2024 | Douglas Electric & Lighting, Inc. (DEL Electric) | Service | Maryland, United States | 147 | Unknown | Source |
| October 2024 | Tekni-Plex, Inc. | Manufacturing | Pennsylvania, United States | 11,485 | Unknown | Source |
| October 2024 | Indian Springs School District 109 | Education | Illinois, United States | 11,542 | Unknown | Source |
| October 2024 | Southern Arkansas University Tech | Education | Arkansas, United States | — | Unknown | Source |
| October 2024 | Gemini Industries, Inc. | Manufacturing | Oklahoma, United States | 557 | Unknown | Source |
| October 2024 | Parkleigh Enterprises Inc. | Retail | New York, United States | — | Unknown | Source |
| October 2024 | Crystal Lake Elementary District 47 | Education | Illinois, United States | 14,207 | Unknown | Source |
| October 2024 | Lighthouse Electric Company, Inc. | Construction | Pennsylvania, United States | 7,128 | Unknown | Source |
| October 2024 | Prefeitura de Pirajuí (SP) | Government | Pirajuí, Brazil | — | Unknown | Source |
| October 2024 | City of Coppell | Government | Texas, United States | 19,640 | Unknown | Source |
| October 2024 | Interboro School District | Education | Pennsylvania, United States | — | Unknown | Source |
| October 2024 | PracticeSuite, Inc. | Healthcare | Florida, United States | 13,353 | Unknown | Source |
| October 2024 | Goodline | Construction | Kawana Waters, Australia | — | Unknown | Source |
| October 2024 | Oklahoma City Abstract & Title Co. | Service | Oklahoma, United States | — | Unknown | Source |
| October 2024 | Elliniko Anoikto Panepistimio (Hellenic Open University) | Education | Patras, Greece | — | Unknown | Source |
| October 2024 | Primăria Sector 5 Bucuresti | Government | Bucharest, Romania | — | No | Source |
| October 2024 | Saizeriya Co,. Ltd. | Food and Beverage | Yoshikawa, Japan | 61,087 | Unknown | Source |
| October 2024 | Grupo Aeroportuario Centro Norte OMA | Transportation | San Pedro, Mexico | — | Unknown | Source |
| October 2024 | Mairie de Mauguio Carnon | Government | Mauguio, France | — | Unknown | Source |
| October 2024 | Yorozu Corporation | Manufacturing | Yokohama, Japan | — | Unknown | Source |
| October 2024 | Star Health and Allied Insurance Co Ltd | Finance | Chennai, India | — | Unknown | Source |
| September 2024 | Special Tree Rehabilitation System | Healthcare | Michigan, United States | 3,820 | Unknown | Source |
| September 2024 | Cardiology of Virginia | Healthcare | Virginia, United States | 21,085 | Unknown | Source |
| September 2024 | HCF Management, Inc. | Healthcare | Ohio, United States | 70,089 | Unknown | Source |
| September 2024 | BayMark Health Services, Inc. | Healthcare | Texas, United States | 16,548 | Unknown | Source |
| September 2024 | Amber Beverage Group | Food and Beverage | Hollerich, Luxembourg | — | Unknown | Source |
| September 2024 | Tecta America Corp. | Construction | Illinois, United States | 22,573 | Unknown | Source |
| September 2024 | Naniwa Pump Mfg. Co., Ltd. | Manufacturing | Osaka, Japan | — | Unknown | Source |
| September 2024 | Liberty First Credit Union | Finance | Nebraska, United States | 52,496 | Unknown | Source |
| September 2024 | Okręgowa Izba Pielęgniarek i Położnych w Gdańsku (District Chamber of Nurses and Midwives in Gdańsk) | Government | Gdansk, Poland | 100 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from RansomHub's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.