emperador
ransomware group · aka Emperor (similarly named 2025 ransomware/extortion brand; any relationship to Emperador is unconfirmed in public reporting) · unknown · active since 2026-09-05 (first leak-site post tracked by this dashboard; any earlier activity unknown)
Victims · 7d
6▲5 vs prev. week
Victims · 30d
18active targets
Victims · 90d
19
All-time (tracked)
19since 2026-08-10
Last post
09-13 12:30UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Emperador is a ransomware/data-extortion brand that maintains a public leak site publicly naming claimed victims; this dashboard first observed its posts on 2026-09-05, and it has claimed four victims to date, most recently on 2026-09-09. Its small victim sample spans government bodies — the Bosnia and Herzegovina Mine Action Center and the Judicial Branch of the Province of Jujuy in Argentina — and private manufacturers in other regions, with no clear sector or geographic concentration yet. Public reporting on the group's operators, national origin, affiliate model, or financial demands is limited or absent, so these remain unknown. Defenders should note that a similarly named 'Emperor' brand was widely reported in 2025 (including as a successor to RansomHub), but any connection between the two is unconfirmed.
Tactics & tooling
- Maintains a public leak/dump site publicly naming claimed victims (observed).
- Claims victims across multiple regions, including Europe, South America, and Asia, with no evident geographic focus (observed).
- Claims government and public-sector entities alongside private-sector manufacturers (observed).
- Low posting volume in the tracked period: four victims in 30 days (observed).
- Extortion methods (encryption vs. data theft, double extortion), initial access vectors, and tooling: not documented in available public reporting (unknown).
Targeted sectors
Government / public sectorManufacturingChemicals
Notable public victims
Bosnia and Herzegovina Mine Action Center, Judicial Branch of the Province of Jujuy, BAYMER, Universal Starch-Chem Allied Ltd
Estimated earnings
No public figure.
Leak-site victims19 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Navitrans | · 2d ago | Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. Publication scheduled: 2026-09-23 13:01:31 UTC Size: 223.2 MB Sectors: Manufacturing, Transportation |
| Nexbex Solutions Private Limited | · 3d ago | Nexbex Solutions Private Limited is a technology consulting and software engineering firm incorporated in November 2023, headquartered in Malappuram, Kerala (India). Classified as an emerging private company, it operates with a paid-up capital of 10 million Indian rupees (₹10 Lakhs) and a compact team, generating estimated annual revenue of less than $1.2 million USD. Its core business focuses on computer programming, custom mobile application development (such as its corporate loyalty platforms Nexi Paints and Grace Petroleum), and digital solutions for retail automation, e-commerce, and smart lead management for growing small and medium-sized enterprises. We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc. 600 MB. Domains: club7ms.com, rayssportsnetwork.com, hwzthat.com, etc. Subdomains Type staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle admin.bookings-staging, backend.academy, admin.spike.booking, etc. We have the source code for all 200+ of their projects. 10 GB +. going up. Publication scheduled: 2026-09-22 13:15:18 UTC Size: 600 MB Sectors: Technology |
| EASY JOB S.A.S. | · 5d ago | Colombian Company. Audit and Tax Audit with more than 5 years of experience Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medellín Colombia. Llámanos o escríbenos: 310 447 2013 - 313 796 9917 The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents 17000 documents Publication scheduled: 2026-09-20 10:21:04 UTC Size: 2.7 GB Sectors: Finance |
| Bosnia and Herzegovina Mine Action Center | · 6d ago | important documents Publication scheduled: 2026-09-19 12:33:49 UTC Size: 1.7 GB Sectors: Other |
| BAYMER | · 6d ago | Important documents Publication scheduled: 2026-09-19 11:23:44 UTC Size: 1.4 GB Sectors: Other |
| Universal Starch-Chem Allied Ltd | · 6d ago | important documents Publication scheduled: 2026-09-19 11:13:14 UTC Size: 3.5 GB Sectors: Other |
| Judicial Branch of the Province of Jujuy | · 10d ago | The official website of the Judicial Branch of Jujuy, Argentina. It provides court information, digital case management, mediation services, legal rulings, and judicial news for legal professionals and the public. Now i have your wordpress databases, login credentials to internal systems(thanks to marcos :)), as well as your email credentials Respond to us, pay the ransom.(Check your emails & check spam as well.) OR email me at : [email protected] for instructions Publication scheduled: 2026-09-19 02:16:35 UTC Size: 4.2 GB Sectors: Government, Law |
| Uniguacu | · 17d ago | full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! Publication scheduled: 2026-09-13 02:22:46 UTC Size: 151.0 MB Sectors: Education |
| Hanwha Renewables | · 18d ago | The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha. We extracted around 12GB of highly sensitive information relating to the following projects: - Bonanza Peak (3GB) - Boulder Solar III (0.7GB) - Obreron Portfolio (4.8GB) - Project Sprout (3.7GB) In the data we found highly sensitive information including: - PPAs - Financial models - Interconnection agreements - Engineering designs of the assets - Personal identifiable information - Sensitive reports, budgets, financial information Reach out to prevent the leak. Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked. Publication scheduled: 2026-09-04 23:48:30 UTC Size: 12GB Sectors: Energy |
| Ipro.com(revealdata.com) customer DB + full database backup | · 19d ago | Yes, this data has been posted before by ME under a different alias, yes the individual that posted the data on cracked.st is a fraud. I am posting this just for fun. Data contains: Customer identifiers, Contact & Location, Account metadata, Internal System IDS, Client relationships. The full database backup contains everything such as transcripts, cases, though it is from 2023. Published Size: 79.5 MB Sectors: Government, Law |
| Capitol Mechanics | · 19d ago | Capitol Mechanics , fresh databases, important docs Publication scheduled: 2026-09-10 08:37:25 UTC Size: 120.9 MB Sectors: Finance, Transportation |
| FRUCASTRO SL | · 23d ago | Recent databases, important documents Publication scheduled: 2026-09-06 11:40:43 UTC Size: 540.1 MB Sectors: Manufacturing |
| Vietnam Electricity(EVNHANOI) | · 24d ago | Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 Size: 300GB Sectors: Government, Energy |
| Test | · 24d ago | test test test Size: 9.8 GB Sectors: Other |
| NetExam | · 26d ago | NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS learning management system built for external audiences rather than internal employees. It helps companies train, certify, and enable their channel partners, customers, and association members, with features like certification tracking, self-paced and instructor-led courses, e-commerce, white-labeling, Salesforce integration, and AI-powered course authoring agents. Headquartered in Dallas, with clients including AMD, AT&T, Oracle, Trellix, and Sabre. Publication scheduled: 2026-09-09 17:06:52 UTC Size: 18.1 MB Sectors: Education, Retail, Other |
| Prefeitura Municipal de Arcos | · 28d ago | We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated. Critical systems have been encrypted. We have your data. You do not. You have 14 days to respond. No response = data published + permanent loss. Contact us through the provided channel. No third parties. No recovery attempts. Publication scheduled: 2026-09-01 07:24:09 UTC Size: 462.3 MB Sectors: Government |
| Albania's Official National Teacher Training Portal | · 29d ago | Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. Publication scheduled: 2026-08-30 21:33:40 UTC Size: 5.9 GB Sectors: Education, Government |
| Albania's official national teacher training portal. | · 29d ago | Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. Publication scheduled: 2026-08-30 21:31:58 UTC Size: 5.9 GB Sectors: Education, Government |
| City Government of Baguio | · Aug 10, 2026 | The City Government of Baguio stands as one of the wealthiest and most prominent local governments in the Philippines. This leak includes highly sensitive and confidential data, such as official contracts, legal permits, identification documents, financial statements, construction blueprints, project proposals, procurement records, and other classified administrative materials. Publication scheduled: 2026-08-25 15:29:08 UTC Size: 2.9 GB Sectors: Government, Finance, Construction |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .