THREAT ACTOR

UMBRA_

Dormant

UMBRA is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.

For Ransomnews editorial coverage of UMBRA, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.

10 Victims tracked

0 / 1 Active mirrors

2026-10-06 First listing

2026-10-10 Most recent

Victims by year

2026 10

Leak site mirrors

1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.

umbra7isogjsgdcndz3uu6qvl5zftjptt6s3iiuecjlwbt4yqyvrhcid.onion UmBra Was Sleepd snapshot · 2026-10-15 00:01

Recent victims

The 50 most recent victims claimed by UMBRA. Total in the index: 10.

Date listed	Victim	Description
2026-10-10	Helwan University (HITU)	Helwan International Technological University — a pioneering Egyptian …
2026-10-08	SOCOCO	[PSA] SOCOCO — A Brazilian mid-sized food company with 40 employees, b…
2026-10-08	Manipal Academy of Higher Edu	[PSA] MAHE — India’s global private university excelling in Medicine, …
2026-10-08	IIT Roorkee	[PSA] IIT Roorkee — India’s oldest institute excelling in Engineering,…
2026-10-08	FSE, Cairo University	[PSA] FSE, Cairo University — Leading Egypt’s future in arts, music, m…
2026-10-07	SANAtech Global Solutions	[PSA] SANAtech Global Solutions is an Egypt-based IT services and soft…
2026-10-07	Raqib	[PSA] Raqib is a Saudi cybersecurity and digital surveillance company …
2026-10-07	Tharisa	[PSA] Tharisa is a Cyprus-based mining group focused on the production…
2026-10-07	Beni Suef Technological University – BTU	Beni Suef Technological University (BTU) is Egypt’s first technologica…
2026-10-06	Four Hands LLC	[PSA] Four Hands LLC is a global leader in lifestyle home furnishings,…

← Back to Ransomtracker

Statistics on this page are computed by Ransomnews from a live leak-site monitoring feed. Numbers update every ten minutes. Operator-written victim descriptions are truncated and shown in snippet form only. Source data: RansomLook (CC BY 4.0), aggregated and adapted by Ransomnews.