ZeroHour

bluewhale

ransomware group · aka BlueWhale (leak-site branding; no widely reported alternate aliases) · unknown - no widely reported public attribution (vendor research, law-enforcement statements, or blockchain-analytics reports) identified · active since 2026-08-14 (first tracked leak-site post per this dashboard; earlier activity unknown)

Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
2
All-time (tracked)
2since 2026-08-14
Last post
08-14 16:43UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

BlueWhale is a low-profile ransomware/data-extortion brand tracked on this dashboard primarily through its public leak site, first recorded 2026-08-14. Tracked history is minimal: two listed victims, FiferFox Minecraft Server and Satellite Developer Server, both posted on or around 2026-08-14, with no new listings in the following week. The small sample suggests targeting of small, internet-facing organizations and community-run infrastructure rather than large enterprises, though broader sector and geographic patterns are unknown. Widely reported public research on the group's malware, affiliate relationships, and revenue is absent, so attribution, origin, and earnings remain unknown. Defenders should treat BlueWhale as sparsely documented and monitor for renewed leak-site activity.

Tactics & tooling
  • Maintains a public leak site to name victims during extortion negotiations
  • Very low victim cadence: two listings total in tracked history as of the dashboard snapshot
  • Listed victims indicate targeting of small, internet-facing organizations, including gaming/community servers and a satellite development firm
  • Whether operations involve file encryption, data exfiltration only, or both is unknown
  • Initial access, persistence, and lateral-movement techniques are unknown; no widely reported vendor incident analyses identified
  • Affiliation with a known ransomware-as-a-service program is unknown; no public attribution
  • Payment rail and typical demand sizes are unknown; no blockchain-analytics reporting identified
Targeted sectors
gaming and online community hostingtechnology (satellite/space-adjacent small business)
Notable public victims

FiferFox Minecraft Server (listed on the group's leak site, on or around 2026-08-14), Satellite Developer Server (listed on the group's leak site, on or around 2026-08-14)

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
FiferFox Minecraft Server · Aug 14, 2026Minecraft Server • 10000 • 3 This is a basic Minecraft Server.
Satellite Developer Server · Aug 14, 2026Developer • 20000 • 5 A software developer at a company

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .