// THREAT ACTOR

SPOOK_

Dormant

SPOOK is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of SPOOK — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.

35 Victims tracked

0 / 1 Active mirrors

2021-10-04 First listing

2021-10-19 Most recent

Victims by year

2021 35

Leak site mirrors

1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.

spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion Spook snapshot · 2021-10-26 02:30

Recent victims

The 50 most recent victims claimed by SPOOK. Total in the index: 35.

Date listed	Victim	Description
2021-10-19	North Island
2021-10-19	All County Surveying Inc
2021-10-19	Page Automation
2021-10-18	Toos Asphalt Company
2021-10-18	Grupo Vía
2021-10-16	NOF CORPORATION
2021-10-16	Apex Filling Systems
2021-10-13	Princess Yachts International
2021-10-12	Neofidelys
2021-10-12	Paris Society
2021-10-11	VKP
2021-10-11	Ferretti International
2021-10-10	CABINET FONT GUILLOT
2021-10-10	Sbc Studio
2021-10-09	Audras & Delaunois
2021-10-09	TV FUEGO
2021-10-09	Kurier
2021-10-08	Kern Glass and Aluminum Company
2021-10-08	La SECAN
2021-10-07	Gestão Contabilidade Empresarial
2021-10-06	MOLNÁRBETON Kft.
2021-10-05	COURTOISE MOTORS
2021-10-05	Cock Foods Co., Ltd.
2021-10-05	Legendary, Inc.
2021-10-04	Sashida warehouse CO., Ltd
2021-10-04	GLOBAL PROTEIN
2021-10-04	Van Dijk De Jongh Notarissen
2021-10-04	TOA ELECTRIC INDUSTRIAL CO., LTD.
2021-10-04	I’M CORPORATION(SUZHOU)CO.,LTD
2021-10-04	ORLANDO IMPORT-EXPORT 2001 SRL
2021-10-04	VIASHOPPING
2021-10-04	Pierce Property Management, Inc.
2021-10-04	ASISMED S.A.
2021-10-04	Transports Verlhac et Fils
2021-10-04	Verhoff Machine & Welding

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.