ZeroHour

audit team

ransomware group · aka audit team (leak-site tracked name); other aliases unknown · unknown · active since 2026-09-08 (first leak-site listing tracked by this dashboard)

Victims · 7d
10▲6 vs prev. week
Victims · 30d
18active targets
Victims · 90d
19
All-time (tracked)
31since 2026-04-07
Last post
09-14 13:39UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

Audit team is a data-extortion group that first appeared in this dashboard's leak-site tracking on 2026-09-08, with six victim listings posted through 2026-09-09. The observed activity consists solely of leak-site victim postings, which implies a data-theft extortion model. Widely reported vendor research on the group's initial access methods, tooling, infrastructure, or affiliate relationships is not yet available. No public earnings estimates, confirmed CVE usage, or individually named notable victims have been identified as of this profile. Defenders should treat details beyond the tracked leak-site activity as unconfirmed.

Tactics & tooling
  • Leak-site victim postings observed (September 2026)
  • Data-theft extortion model implied by leak-site activity
  • Initial access techniques: unknown
  • Ransomware deployment vs. exfiltration-only operation: unknown
  • Affiliate or RaaS relationships: unknown
  • Tooling, infrastructure, and geographic focus: unknown
Targeted sectors
unknown
Notable public victims

dg***kr, go***et, kr***rg, bu***en, Wi***IT, pa***op

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
AUDIT ENTITY: Ne***ox · 1d agoAUDIT ID: 42FFBFBFF9241F2E / DISCOVERY DATE: 2026-09-14
AUDIT ENTITY: vi***in · 2d agoAUDIT ID: 5DC9129A6EA7F384 / DISCOVERY DATE: 2026-09-13
AUDIT ENTITY: TE***PB · 3d agoAUDIT ID: 993E2D59C377AFDE / DISCOVERY DATE: 2026-09-12
AUDIT ENTITY: ki***jp · 4d agoAUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09
AUDIT ENTITY: my***ru · 4d agoAUDIT ID: D91BED92A5A9223F / DISCOVERY DATE: 2026-09-09
AUDIT ENTITY: mo***al · 5d agoAUDIT ID: 2431ED9F65ADD5B1 / DISCOVERY DATE: 2026-09-10
AUDIT ENTITY: dg***kr · 6d agoAUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08
AUDIT ENTITY: go***et · 6d agoAUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08
AUDIT ENTITY: kr***rg · 6d agoAUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08
AUDIT ENTITY: bu***en · 6d agoAUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08
AUDIT ENTITY: Wi***IT · 7d agoAUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08
AUDIT ENTITY: pa***op · 7d agoAUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08
AUDIT ENTITY: mansurovogroup · 11d agoAUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26
AUDIT ENTITY: PIT.local · 11d agoAUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27
AUDIT ENTITY: PI***al · 19d agoAUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27
AUDIT ENTITY: Demidov Steel Group · 20d agoAUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18
AUDIT ENTITY: ma***up · 20d agoAUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26
AUDIT ENTITY: De***up · 28d agoAUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18
AUDIT ENTITY: I-SYS · Jun 25, 2026AUDIT ID: C66B828414389C27 / DISCOVERY DATE: 2026-06-15
AUDIT ENTITY: I-***YS · Jun 15, 2026AUDIT ID: C66B828414389C27 / DISCOVERY DATE: 2026-06-15
AUDIT ENTITY: ca***lm · Jun 2, 2026AUDIT ID: 168B1F8DD83F7DD9 / DISCOVERY DATE: 2026-06-02
AUDIT ENTITY: On***de · May 28, 2026AUDIT ID: DF2287D8C495C426 / DISCOVERY DATE: 2026-05-28
AUDIT ENTITY: Mopas Online Supermarket · May 23, 2026AUDIT ID: CC92E841B75A3DF6 / DISCOVERY DATE: 2026-05-15
AUDIT ENTITY: Trésor Public · May 18, 2026AUDIT ID: D6A9F21B7E4C3A59 / DISCOVERY DATE: 2026-05-10
AUDIT ENTITY: Mo***et · May 15, 2026AUDIT ID: CC92E841B75A3DF6 / DISCOVERY DATE: 2026-05-15
AUDIT ENTITY: Tr***ic · May 10, 2026AUDIT ID: D6A9F21B7E4C3A59 / DISCOVERY DATE: 2026-05-10
AUDIT ENTITY: [ COOPERATION REACHED ] China · Apr 7, 2026// ALL ACQUIRED DATA HAS BEEN PURGED FROM OUR SERVERS // ENTERPRISE SECURITY REMEDIATION VERIFIED // ENTITY HAS DEMONSTRATED HIGH SECURITY COMPLIANCE // NO FURTHER ACTION REQUIRED — CASE CLOSED
AUDIT ENTITY: [ COOPERATION REACHED ] Thailand · Apr 7, 2026// ALL ACQUIRED DATA HAS BEEN PURGED FROM OUR SERVERS // ENTERPRISE SECURITY REMEDIATION VERIFIED // ENTITY HAS DEMONSTRATED HIGH SECURITY COMPLIANCE // NO FURTHER ACTION REQUIRED — CASE CLOSED
AUDIT ENTITY: [ COOPERATION REACHED ] Hong Kong · Apr 7, 2026// ALL ACQUIRED DATA HAS BEEN PURGED FROM OUR SERVERS // ENTERPRISE SECURITY REMEDIATION VERIFIED // ENTITY HAS DEMONSTRATED HIGH SECURITY COMPLIANCE // NO FURTHER ACTION REQUIRED — CASE CLOSED
AUDIT ENTITY: joycity · Apr 7, 2026Joycity is a prominent South Korean game developer and publisher founded in 1994 and listed on the KOSDAQ. Renowned for its innovation and global reach, the company originally pioneered the hip-hop-themed sports genre with its self-developed FreeStyle series, which became a cultural milestone for players across Asia. In the mobile era, Joycity successfully pivoted to the Strategy (SLG) genre, producing high-revenue titles like Gunship Battle: Total Warfare and Pirates of the Caribbean: Tides of War, with international markets consistently accounting for over 70% of its total revenue. Currently, Joycity is actively expanding into Web3 technologies and major cross-platform projects. Its blockbuster collaboration with Capcom and Aniplex, Resident Evil Survival Unit, has already surpassed 5 million global downloads as of early 2026, demonstrating the company’s robust R&D and operational expertise in managing world-class intellectual properties.
AUDIT ENTITY: Kawasaki Motors Philippines Corporation · Apr 7, 2026Kawasaki Motors Philippines Corporation (KMPC), located in Muntinlupa, Metro Manila, is a leading manufacturer and distributor of Kawasaki motorcycles in the Philippines, operating for over 40 years. As an affiliate of Kawasaki Heavy Industries, Ltd. (KHI), it produces commuter bikes, tricycles, and underbones, with an annual capacity of 250,000 units, making it one of the largest plants in Kawasaki's global network.

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .