THREAT ACTOR
REDALERT_
DormantREDALERT is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of REDALERT, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2022 6
Leak site mirrors
5 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
blog2hkbm6gogpv2b3uytzi3bj5d5zmc4asbybumjkhuqhas355janyd.onionBoard of shame snapshot · 2022-12-08 10:07 -
qrcxhs4x2n4a65rk3zbwm5hu6475bi4w2mdjhfmusovnjc6hc6qcv3ad.onionsnapshot · 2024-12-10 15:41 -
ocsmkribkmoij3uhvhxlpxlpebqhzo5uingee7mvebnv57jqya745uyd.onionsnapshot · 2024-12-10 15:42 -
ybxtfftwy2iwfqjy7fvvcrt5sd55fx3sk2yuztbx3y2dxb4dvqdhsiid.onionsnapshot · 2024-12-10 15:42 -
gwvueqclwkz3h7u75cks2wmrwymg3qemfyoyqs7vexkx7lhlteagmsyd.onionsnapshot · 2024-12-10 22:37
Recent victims
The 50 most recent victims claimed by REDALERT. Total in the index: 6.
| Date listed | Victim | Description |
|---|---|---|
| 2022-09-22 | www.bbadmin.com | We have easily hacked corporate network of bbadmin.com and downloaded … |
| 2022-09-14 | groupg4.com | We have easily hacked corporate network of groupg4.com We downloaded l… |
| 2022-08-18 | syredis.fr | We have easily hacked corporate network of syredis.fr and downloaded m… |
| 2022-08-18 | vahanen.com | We have hacked corporate network of vahanen.com and downloaded more th… |
| 2022-08-18 | keystonelegal.co.uk | We have easily hacked corporate network of keystonelegal.co.uk and dow… |
| 2022-08-18 | coarc.org |
CONFIRMED ATTACKS
Redalert confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Redalert incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in July 2022. Finland accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is service, at 1 confirmed victim. Where a figure was disclosed (1 case), these incidents account for 5,701 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Redalert incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2022 | Vahanen | Service | Espoo, Finland | — | Unknown | Source |
| July 2022 | NYSARC Columbia County Chapter | Healthcare | New York, United States | 5,701 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Redalert's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.