THREAT ACTOR
TRIPLE-X_
DormantTRIPLE-X is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of TRIPLE-X, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 4
Leak site mirrors
2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
ojcmpbdncjo5dhaxxll44bq6to3kwqtoeraevgsjquhdtt4uv5l4igid.onionWelcome to TRIPLE X WebBlog snapshot · 2026-08-18 21:06 -
6qqz6m3b6htudohg2mlf5gdcalonxy3sh5g4dix4mpyirjcgelqqufad.onionsnapshot · 2026-08-18 16:17
Recent victims
The 50 most recent victims claimed by TRIPLE-X. Total in the index: 4.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-05 | Henshaw Law | 1 terabytes of people's data https://henshawlawak.com/ Henshaw Law, De… |
| 2026-07-24 | Bank of Baroda bigest indian bank bankofbaroda.bank.in | 1 terabytes of people's data https://bankofbaroda.bank.in/ Imagine I'm… |
| 2026-06-13 | Law Offices US immigrationonline.com | https://immigrationonline.com/ 1.5 terabytes of people's data in a imm… |
| 2026-05-21 | Bni.co.id bank of indonesia free data. |
CONFIRMED ATTACKS
Triple X confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Triple X incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2026 to July 2026. United States accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is legal, at 1 confirmed victim. Where a figure was disclosed (1 case), these incidents account for 1,148 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Triple X incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Bank of Baroda | Government | Vadodara, India | — | Unknown | Source |
| May 2026 | Law Offices of Rakesh Mehrotra | Legal | Virginia, United States | 1,148 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Triple X's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.