// THREAT ACTOR
SETTRA_
ActiveSETTRA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of SETTRA — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 36
Leak site mirrors
5 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
settra5ldqwgtw5q7z5awbsvlksakyfojuc5slgrz5lvapune4fantqd.onionsnapshot · 2026-08-20 00:21 -
26z3gms2rshr2zzedxhw5fbucilmgt2inhmxzmuhteyztpxohoqplgyd.onionsnapshot · 2026-06-26 19:11 -
ttfy4zmtiaywfkkmykpxiwtlxkcr5ofvrhqgxxyspgwzbxkc3uze7jid.onionsnapshot · 2026-06-26 19:11 -
c3u3g7dz2yxkefci3x34jfvfa4gka4iogi4zfjkyxx2c536oqdld4kid.onionsnapshot · 2026-06-26 19:11 -
pbxvml6h3wz35qlr5muy2cg5jvjsd4qhjlsztmxj4lqkyohnfdrntqyd.onionsnapshot · 2026-06-26 19:35
Recent victims
The 50 most recent victims claimed by SETTRA. Total in the index: 36.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-11 | oligo.de | Revenue: 12,500,000 Size: N/A | A group of companies whose luminaires … |
| 2026-08-11 | flowco-inc.com | Revenue: 776,900,000 Size: 1200GB | DEEP WELL: Flowco Production Solut… |
| 2026-08-11 | firstdigital.com | Revenue: 44,000,000 Size: N/A | The Digital Cartel: How a Telecom Empi… |
| 2026-08-11 | powdr.com | Revenue: 400,000,000 Size: 120GB | Point of No Return: What the Ski Em… |
| 2026-08-11 | advancedtaxsolutions.com | Revenue: 7,100,000 Size: N/A | Frank Rim & Associates: Archive of … |
| 2026-08-11 | profinrg.nl | Revenue: 6,200,000 Size: N/A | How Profinergy BV Lost Control of Thous… |
| 2026-07-23 | menlosystems.com | Revenue: 20,000,000 Size: 240GB | FREQUENCY COMB ON TWO FRONTS A Germa… |
| 2026-07-23 | royalchain.com | Revenue: 12,500,000 Size: 241GB | Royal Chain Group: Jewelry Business … |
| 2026-07-21 | downies.com | Revenue: 16,000,000 Size: 550GB | Downies Collectables Pty Ltd: $1.4M … |
| 2026-07-16 | samuelkoon.com | Revenue: 5,000,000 Size: 748GB | How Samuel D. Koon & Associates C… |
| 2026-07-16 | torsiongroup.co.uk | Revenue: 5,000,000 Size: 400GB | END OF THE LINE A company that builds… |
| 2026-07-16 | acilab.com | Revenue: 12,000,000 Size: 653GB | How ACI Financed Its Owners' Compani… |
| 2026-07-09 | gvfsinc.com | Revenue: 20,500,000 Size: 36GB | GREEN VALLEY: SELF-LEASE SCHEME How a… |
| 2026-07-09 | wtlawllp.co.uk | Revenue: 5,000,000 Size: 19GB | WT Law LLP: Internal Documents of a UK… |
| 2026-07-09 | bergdemo.com | Revenue: 42,000,000 Size: 543GB | Berg / Crushing Corporation of Ameri… |
| 2026-06-30 | petradiamonds.com | Revenue: 207,000,000 Size: 50GB | THE DIAMOND ARCHIVE: Petra Diamonds … |
| 2026-06-30 | orion4value.com | Revenue: 6,200,000 Size: 50GB | THE CERTIFICATE AS A VULNERABILITY: Do… |
| 2026-06-30 | clc-tn.com | Revenue: 6,300,000 Size: 99GB | City Lumber Company: Building Material… |
| 2026-06-30 | wilfley.com | Revenue: 26,300,000 Size: 410GB | SEAL FAILURE A company that builds p… |
| 2026-06-30 | joyconstructionnyc.com | Revenue: 37,400,000 Size: 261GB | Joy Construction Corp: $1.3 Billion … |
| 2026-06-30 | rcfassoc.com | Revenue: 5,000,000 Size: 39GB | R.C. FIELDS & ASSOCIATES: Client D… |
| 2026-06-30 | ilex-paysages.com | Revenue: 5,000,000 Size: 116GB | LANDSCAPE ARCHIVE: How Ilex Paysages … |
| 2026-06-30 | owensborograin.com | Revenue: 35,600,000 Size: 171GB | PROCESSING: GRAIN IN SOMEONE ELSE'S … |
| 2026-06-30 | infinedi.net | Revenue: 17,900,000 Size: 86GB | Clearinghouse The company doctors pay… |
| 2026-06-30 | vcnyhome.com | Revenue: 176,000,000 Size: 1TB | THE VCNY HOME ARCHIVE The company tha… |
| 2026-06-26 | lifevantage.com | 585 GIGABYTES — leaked data that was meant to stay hidden. A complete … |
| 2026-06-26 | turbodata.com | A parking ticket is the most trivial document that can enter your life… |
| 2026-06-26 | qdi.com | Quality Dining, Inc. Accounting Archive — we have more than 1,000 vers… |
| 2026-06-26 | dystar.com | 1.3 terabytes of data — from a company that manufactures dyes for the … |
| 2026-06-26 | pchome.com.tw | A payment company sells trust, security, and reliability. Its internal… |
| 2026-06-26 | va-glass.com | We have an archive of data from Virginia Glass & Mirror Holdings LLC —… |
| 2026-06-26 | tmscentral.com | In the archive of Total Monitoring Services: dealer agreements; a subc… |
| 2026-06-26 | doosan.com | Over 3.2 terabytes of data. A complete digital snapshot of a corporate… |
| 2026-06-26 | hmcfarms.com | Inside the THE HMC GROUP company archive: tax returns for twenty-five … |
| 2026-06-26 | conduril.pt | Conduril builds dams. Bridges. Ports. The kind of things that stand fo… |
| 2026-06-26 | canopybrands.us | A holding company that sells people safety at height failed to keep it… |
// CONFIRMED ATTACKS
Settra confirmed attacks: 4 verified incidents
Ransomnews has verified 4 Settra incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2026 to July 2026. United States accounts for 3 of them (75%), with victims recorded in 2 countries in total. The most affected sector is retail, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Settra incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Downies Collectables Pty Ltd. | Retail | Nunawading, Australia | — | Unknown | Source |
| June 2026 | Berg Demo Group, LLC | Construction | Maryland, United States | — | Unknown | Source |
| June 2026 | HMC Fresh Foods, LLC (HMC Farms & McClarty Farms) | Food and Beverage | California, United States | — | Unknown | Source |
| June 2026 | InfinEDI, LLC | Healthcare | Oklahoma, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Settra's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.