THREAT ACTOR
TOUFAN_
ActiveTOUFAN is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of TOUFAN, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 1
- 2025 39
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
toufanleaks.orgCyber Toufan snapshot · 2026-09-23 05:14
Recent victims
The 50 most recent victims claimed by TOUFAN. Total in the index: 40.
| Date listed | Victim | Description |
|---|---|---|
| 2026-01-06 | ILDefenseLeaks : Optum Industrial Engineering Systems – https://optum-ies.com | O Zionists..Cursed be you morning and evening.You are still bombing ch… |
| 2025-12-12 | ILDefenseLeaks : UPC Precision Castings Ltd – “upccastings.com” | Rain has always been a source of joy and blessing for all people, but … |
| 2025-12-10 | ILDefenseLeaks : Saar Engineering – “saarengineer.com” | This day is a precious day for our hearts, the day of the liberation o… |
| 2025-11-28 | ILDefenseLeaks : CR Casting, Exact LTD and Tefen Metal Castings | The Zionist enemy is still killing innocents, not respecting or honori… |
| 2025-10-30 | ILDefenseLeaks : Maya Engineering – “maya-il.com” | O you Zionists, 100 martyrs in one day for violating the ceasefire in … |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x08 : Gavriel Machal Law Firm | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x09 : . IZHAR ENGINEERING SERVICES LTD. | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x10 : THE PHOENIX | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x11 : exposing 20 complicit law firms | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x12 : Zevulun Marine Systems LTD | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x13 : yechavedaat.org | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x14 : shiran-tours.co.il | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x15 : Oz Aviation ltd. | 🔴Bismillah…— “Enter Upon Them By The Gate, and when you enter it, you … |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x16 : Rational-Solutions | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-04 | Operation – “Enter Upon Them By The Gate” – 0x17 : ACOM Communication Strategies | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-02 | Operation – “Enter Upon Them By The Gate” – 0x01 : safety-car | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-01 | Operation “ادْخُلُوا عَلَيْهِمُ الْبَابَ” – “Enter Upon Them By The Gate” – 0x01 | 🔴Bismillah…— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ ا… |
| 2025-10-01 | Operation “ادْخُلُوا عَلَيْهِمُ الْبَابَ” – “Enter Upon Them By The Gate” – 0x02 | 🔴 Bismillah…🔻🔻0x02🔻🔻 — “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَ… |
| 2025-10-01 | Operation “ادْخُلُوا عَلَيْهِمُ الْبَابَ” – “Enter Upon Them By The Gate” – 0x03 | — “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَلَیْهِمُ الْبَابَ” —F… |
| 2025-10-01 | Operation “ادْخُلُوا عَلَيْهِمُ الْبَابَ” – “Enter Upon Them By The Gate” – 0x04 | 🔴 Bismillah… 🔻🔻0x04🔻🔻— “Enter Upon Them By The Gate” —— “ادْخُلُوْا عَ… |
| 2025-09-05 | Operation – “Enter Upon Them By The Gate” – JCHC – 0x06 | 🔴 Bismillah… The suffering continues. Bombs are falling, children are … |
| 2025-09-05 | Operation – “Enter Upon Them By The Gate” – GoldenBit – 0x07 | 🔴 Bismillah… The act is over. The image they’ve carefully built of bei… |
| 2025-09-05 | New Telegram Channel : https://t.me/CyberToufan02 | To Our Beloved Followers,Thank you for your unwavering support, especi… |
| 2025-09-05 | Operation – “Enter Upon Them By The Gate” – yechavedaat – 0x13 | 🔴 Bismillah… yechavedaat.org has role in promoting violence and hatred… |
| 2025-09-05 | Operation – “Enter Upon Them By The Gate” – oz-aviation-ltd – 0x15 | 🔴 Bismillah… The ongoing genocide in Gaza has led to the heartbreaking… |
| 2025-09-03 | New Telegram Channel : https://t.me/CyberToufan02 | New Telegram Channel : https://t.me/CyberToufan02 To Our Beloved Foll… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – LAW FIRMS SCANDAL – 0x11 | You who falsely claim to be guardians of law and justice! You are the … |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – BREACH OF ZIONIST “THE PHOENIX”- 0x10 | Bismillah… MAJOR CYBER STRIKE: FULL BREACH OF ZIONIST “THE PHOENIX” (f… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – A. IZHAR ENGINEERING SERVICES LTD- 0x09 | Bismillah… They celebrate their small victories while Gaza bleeds. The… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – Gavriel-Malach – 0x08 | Netanyahu is at it again. He thinks another war will hide his failures… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – GoldenBit – 0x07 | The act is over. The image they’ve carefully built of being strong and… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – JCHC – 0x06 | The suffering continues. Bombs are falling, children are crying, and t… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – Go-net – 0x05 | 🔻🔻0x05🔻🔻 — “Enter Upon Them By The Gate” — — “ادْخُلُوْا عَلَیْهِمُ … |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – Mann-Shinar – 0x04 | 🔻🔻0x04🔻🔻 — “Enter Upon Them By The Gate” — — “ادْخُلُوْا عَلَیْهِمُ … |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – Edri-ltd – 0x03 | From transportation sector to construction sector and even more. As ou… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – DataCar – 0x02 | Today should be yet another reminder that you will NEVER get anywhere … |
| 2025-09-03 | Operation -“Enter Upon Them By The Gate”- Safety-Car – 0x01 | — "Enter Upon Them By The Gate" — — "ادْخُلُوْا عَلَیْهِمُ الْبَابَ" … |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – yechavedaat – 0x13 | yechavedaat.org has role in promoting violence and hatred against Pale… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – shiran-tours – 0x14 | The Israeli invasion in Gaza has severely disrupted transportation and… |
| 2025-09-03 | Operation – “Enter Upon Them By The Gate” – oz-aviation-ltd – 0x15 | The ongoing genocide in Gaza has led to the heartbreaking loss of over… |
CONFIRMED ATTACKS
Toufan confirmed attacks: 1 verified incident
Ransomnews has verified 1 Toufan incident against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. All of them fall in November 2023. Israel accounts for 1 of them (100%). The most affected sector is government, at 1 confirmed victim.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Toufan incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| November 2023 | Israel Government Archive | Government | Jerusalem, Israel | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Toufan's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.