eraleign (apt73)
ransomware group · aka Eraleign, Apt73 (tracking name used on this dashboard) · unknown (no widely reported attribution or country of origin) · active since 2026-06-23 (first tracked leak-site victim post per this dashboard; earlier activity unknown)
Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
13
All-time (tracked)
177since 2024-04-23
Last post
07-24 11:59UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Eraleign (tracked on this dashboard as apt73) is a data-extortion group whose leak-site activity was first tracked on 2026-06-23, with 13 victims posted through 2026-07-24. Posting is intermittent, with bursts of listings followed by multi-week gaps and zero new victims in the most recent 7- and 30-day windows. The victim set is globally distributed and sector-diverse, spanning a Brazilian government domain (gov.br), Vienna International Airport, cement, mining, IT/hosting, e-commerce, and hospitality targets, suggesting opportunistic rather than sector-focused targeting. In at least one case (Vienna Airport) the group marked the victim's data as sold to a third party rather than published, indicating data-sale monetization alongside leak-site extortion. Attribution, origin, initial-access methods, tooling, and earnings are not established in widely available public reporting and remain unknown.
Tactics & tooling
- Publishes stolen victim data on a dedicated leak site when extortion goes unresolved
- Sells stolen data to third parties (one tracked victim flagged 'SOLD TO 3RD PARTY' per this dashboard)
- Opportunistic, multi-region, multi-sector victim selection based on tracked posts
- Intermittent leak-site cadence, with multi-week gaps between victim posts
- Initial access vectors, malware/tooling, and whether encryption is used in intrusions: unknown in public reporting
Targeted sectors
GovernmentAviation/transportBuilding materials/cementMiningIT services/hostingRetail/e-commerceGaming/hospitalityNo established sector focus (based on 13 tracked victims)
Notable public victims
Vienna International Airport (viennaairport.com) - listing flagged 'SOLD TO 3RD PARTY' per this dashboard, Brazilian federal government (gov.br) - listed on leak site per this dashboard, Kliknklik e-commerce platform (kliknklik.com) - listed on leak site per this dashboard
Estimated earnings
No public figure.
Leak-site victims177 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| aliorbank.pl | · Jan 4, 2025 | Polish bank. Financial docs, internal docs. 0,06 GB of data. |
| fpj.com.py PART3 | · Jan 4, 2025 | Paraguayan bank. Personal info. _____________________________ Part 3 |
| bms.com | · Jan 4, 2025 | Pharmaceutical company. personal data - 302 lines |
| minerasancristobal.com | · Jan 4, 2025 | Minerals & Mining. financial docs, internal docs, personal docs. |
| prixet.com | · Jan 4, 2025 | We are a technology company based in Europe and the Caribbean. We are dedicated to data creation ... |
| bri.co.id (SOLD TO 3RD PARTY) | · Dec 24, 2024 | (TOTAL AMOUNT SOLD TO 3RD PARTY) Bank Rakyat Indonesia (BRI) is one of the largest commercial banks in Indonesia that always prioritizes customer s... |
| federalbank.co.in (PART1) | · Dec 24, 2024 | Sharing a little part with you. Indian bank. Full amount - 637895 lines CUSTOMERNAME CUST_ID_N FNAME DOB PAN_NO MNAME LNAME AGE SEX FATHERNAME SPOU... |
| n4telecom.com.br | · Dec 23, 2024 | Our mission - Provide telecommunications solutions with quality and humane service, connecting people and growing businesses. |
| linebank.co.id | · Dec 23, 2024 | Indonesia Digital Banking personal info |
| federalbank.co.in | · Dec 19, 2024 | Indian bank. 637895 lines CUSTOMERNAME CUST_ID_N FNAME DOB PAN_NO MNAME LNAME AGE SEX FATHERNAME SPOUSENAME DRIVINGLICENSENO PASSPORT... |
| bri.co.id | · Dec 18, 2024 | Bank Rakyat Indonesia (BRI) is one of the largest commercial banks in Indonesia that always prioritizes customer satisfaction. Personal data, clien... |
| www.prixet.com | · Dec 16, 2024 | We are a technology company based in Europe and the Caribbean. We are dedicated to data creation through hotspots. We create the different hotspots... |
| bankily.mr | SOLD | · Dec 12, 2024 | The BANKILY product is a mobile banking product from Banque Populaire de Mauritanie. Employee names and data, including the admin’s username, cus... |
| www.minerasancristobal.com | · Dec 11, 2024 | Minerals & Mining. financial docs, internal docs, personal docs. |
| leadboxhq.com | · Dec 10, 2024 | Advertising & Marketing / clients' data / id index score source closed_at company: id name uuid contact id name phone uuid created_at ... |
| melhorcompraclube.com.br | · Dec 9, 2024 | The Best Purchase Club is a cashback platform that was born as a product of Telepequisa, a potiquis company with almost 30 years of experience in t... |
| www.bms.com | · Dec 9, 2024 | Pharmaceutical company. personal data - 302 lines |
| bankily.mr | · Dec 9, 2024 | The BANKILY product is a mobile banking product from Banque Populaire de Mauritanie. Employee names and data, including the admin’s username, cu... |
| www.fpj.com.py PART3 | · Dec 7, 2024 | Paraguayan bank. Personal info. _____________________________ Part 3 |
| azpay.me | · Dec 5, 2024 | Azape began its journey in 2018 by developing customized projects for various market segments, with its focus on developing solutions for intermedi... |
| www.aliorbank.pl | · Dec 5, 2024 | Polish bank. Financial docs, internal docs. 0,06 GB of data. |
| www.fpj.com.py PART2 | · Dec 4, 2024 | Paraguayan bank. Personal info. _____________________________ Part 2 |
| www.certifiedinfosec.com | · Dec 4, 2024 | Certified Information Security is a registered trade name for Certified Tech Trainers (CTT) (D-U-N-S# 010573009) (CAGE code: 3FKS0), a corporation ... |
| www.fpj.com.py PART1 | · Dec 3, 2024 | Paraguayan bank. Personal info. _____________________________ Part 1 |
| www.siapenet.gov.br | · Dec 3, 2024 | Today, SIAPE processes the remuneration of civil servants, regulated both by the uniform federal legal regime (Law 8,112/90) and by the CLT and oth... |
| www.sansirostadium.com | · Nov 30, 2024 | Italian stadium. Total machines accesses, main stations, footballers' personal data, UEFA personal contact data, big screens control machines. 1 ... |
| www.fpj.com.py | · Nov 29, 2024 | Paraguayan bank. Personal info - 2 GB |
| www.polleninformation.at | · Nov 27, 2024 | Pollen situation informational site. Personal info + Pass. 22140 lines |
| www.sella.eng.br | · Nov 26, 2024 | mentoring programs for managers. Internal and personal docs. 0.3 GB |
| www.netromsoftware.ro | · Nov 25, 2024 | Romanian software development company. Export CRM |
| lgpunjab.gov.in | · Nov 23, 2024 | GOVERNMENT OF PUNJAB Backup CRM, 0.2 GB |
| gureco.pl | · Nov 23, 2024 | Gureko GURECO Sp. z o.o. is a private company. We began our activity on 10 March 2008 based on an entry in the Register of Economic Activities of t... |
| www.sfr.fr | · Nov 21, 2024 | SFR is a French telecommunications company. It is both the second oldest mobile network operator and the second largest telecommunications company ... |
| rao.hr | · Nov 20, 2024 | RAO d.o.o. is a member of the Best in Parking AG group, Austria. With more than a quarter of a century of dedication and professional work, it is a... |
| www.protectasecurity.pe | · Nov 18, 2024 | Protecta Security provides insurance, microfinance and financial services. Internal docs, financial docs, personal info, customers' personal info.... |
| nanolive.ch 2.0 | · Nov 13, 2024 | Nanolive’s label-free live cell imaging and analysis platforms, consumables and services are built on technology that is 100% non-invasive, thus ... |
| emefarmario.com.br | · Nov 9, 2024 | We are the Emefarma Group! A leading pharmaceutical distribution company that grew with the purpose of bringing health and well-being to people's l... |
| liftkits4less.com | · Nov 8, 2024 | LIFTKITS4LESS.COM is the largest online seller of suspension lift kit systems. clients' data: ID,Name,Email,Group,Phone,ZIP,Country,State/Province... |
| www.lamaisonducitron.com | · Nov 8, 2024 | Lemon product store. |
| www.baldinger-ag.ch | · Nov 8, 2024 | Since 1970, Baldinger Fahrzeugbau has stood for continuous innovation and the highest quality. We are still the leading manufacturer of light comme... |
| www.assurified.com | · Nov 8, 2024 | Assurified revolutionizes risk management for multifamily real estate. Our AI-powered solutions and deep expertise in Total Cost of Risk (TCOR) opt... |
| www.botiga.com.uy | · Nov 8, 2024 | An online store where you will find everything you need and want for you and your family. We have over 10,000 products to complement every stage o... |
| www.trinitesolutions.com | · Oct 29, 2024 | Trinite Solutions was established in 2003. Its mission is to develop, market and implement business software solutions for all sizes of enterprise.... |
| www.scopeset.de | · Oct 29, 2024 | We offer support services for all our developed solutions and tools with an emphasize on direct access to our experts and quick turn around times f... |
| sokkakreatif.com | · Oct 29, 2024 | PT. Sokka Kreatif Teknologi was established in 2017, and is a subsidiary of PT. Persada Inti Utama whose main businesses include telecommunications... |
| www.legilog.fr | · Oct 29, 2024 | Management software for culture, businesses, religion and bishoprics. 10 GBs crm systems / export files and backups / personal data |
| pkaufmann.com | · Oct 24, 2024 | P/Kaufmann Fabrics is the premier home furnishings textile converter, having supplied our customers with expertly-crafted designs for over sixty fi... |
| modplan.co.uk | · Oct 24, 2024 | For over 50 years, Modplan has been manufacturing and supplying leading-edge products to our installing partners for the fenestration market. Funda... |
| hpecds.com | · Oct 24, 2024 | CDS, a Hewlett Packard Enterprise company CDS is a wholly owned subsidiary of Hewlett Packard Enterprise and although an integral part of delivery... |
| thompsoncreek.com | · Oct 24, 2024 | Thompson Creek® Window Company is the Mid-Atlantic region’s premier home improvement replacement products company. We have been customizing and ... |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .