// THREAT ACTOR
TEAM-UNDERGROUND_
ActiveTEAM-UNDERGROUND is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of TEAM-UNDERGROUND — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 6
- 2024 21
Leak site mirrors
4 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onionSignIn | Chat snapshot · 2023-09-30 12:09 -
ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onionSignIn | Chat snapshot · 2025-03-05 15:00 -
47glxkuxyayqrvugfumgsblrdagvrah7gttfscgzn56eyss5wg3uvmqd.onionAll data | Underground store snapshot · 2026-08-06 21:15 -
2nyysjgsfhnwizvbhjeklagbdbjz2z27meao7asl73zcqpb5cr4n4eyd.onionSignIn | Chat snapshot · 2025-12-10 13:07
Recent victims
The 50 most recent victims claimed by TEAM-UNDERGROUND. Total in the index: 27.
| Date listed | Victim | Description |
|---|---|---|
| 2025-08-15 | SFA Engineering | |
| 2025-08-15 | www.sfa.co.kr | |
| 2025-06-25 | GMORS Co., Ltd | |
| 2025-04-16 | semex.com | |
| 2025-04-08 | shengyusteel.com | |
| 2025-02-18 | Afa Systems Ltd. | |
| 2024-12-16 | Simmtech Co., Ltd. | |
| 2024-10-25 | hcsgcorp.com | |
| 2024-10-10 | Casio Computer Co., Ltd | |
| 2024-07-03 | ramservices.com | |
| 2024-07-01 | Ethypharm | |
| 2024-06-17 | A-Line Staffing Solutions | |
| 2024-06-12 | belcherpharma.com | |
| 2024-06-10 | CentralSecurities.com | |
| 2024-05-18 | www.belcherpharma.com | |
| 2024-05-03 | kc.co.kr | |
| 2024-05-01 | bulldogbag.com | |
| 2024-05-01 | frenckengroup.com | |
| 2024-05-01 | synology.com | |
| 2024-05-01 | tpa-group.sk | |
| 2024-05-01 | Triathlon.group | |
| 2024-05-01 | awwg.com | |
| 2024-05-01 | KyungChang | |
| 2024-05-01 | Y. Hata & Co., Ltd. | |
| 2024-05-01 | Skender Construction | |
| 2024-05-01 | Creative Business Interiors | |
| 2024-05-01 | cochraneglobal.com |