icarus
ransomware group · aka Icarus · unknown · active since unknown; sparse vendor reporting in 2025 described activity under this name, and this dashboard began tracking its leak-site listings on 2026-06-16
Icarus is a ransomware/data-extortion group tracked by this dashboard via its leak-site listings, with 12 victims posted since tracking began on 2026-06-16 and the most recent post on 2026-06-23. All tracked activity occurred in a single burst in June 2026, followed by roughly four weeks with no new postings. Its victim list is sector-diverse, spanning cybersecurity (Huntress), software/SaaS (Klue), and financial services (The Credit Pros), alongside several less readily identifiable organizations. Public reporting on the group's operators, origin, affiliate ties, and earnings is sparse, so those details are treated as unknown here; limited 2025 vendor write-ups portrayed it as a newer leak-site extortion operation reportedly focused on financial-sector victims.
- Maintains a public leak site used to name victims as leverage in extortion negotiations
- Publishes victims in concentrated bursts rather than a steady cadence (all 12 tracked victims appeared within roughly one week, June 2026)
- Targets a sector-diverse victim pool including IT/security, software, and financial services organizations, suggesting broad, opportunistic selection based on leak-site listings
- Initial access vectors, tooling, and whether attacks involve file encryption are not established in widely available public reporting (unknown)
Huntress (managed detection and response provider), Klue (klue.com - competitive enablement SaaS), The Credit Pros (thecreditpros.com - credit services company)
No public figure.
Leak-site victims13 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| H* | · Jun 23, 2026 | Salesforce data of H*. |
| H** | · Jun 23, 2026 | Salesforce data for this corp. |
| G* | · Jun 23, 2026 | Salesforce data for this corp. |
| C* | · Jun 23, 2026 | Salesforce data for this corp. |
| Huntress | · Jun 22, 2026 | Salesforce data of Huntress. |
| HDS (Hdscorp) | · Jun 22, 2026 | Salesforce data for this corp. |
| Gms-net | · Jun 22, 2026 | Salesforce data for this corp. |
| Cqcrm | · Jun 22, 2026 | Salesforce data for Cqcrm |
| Cbassociations | · Jun 22, 2026 | Salesforce data for this corp. |
| DEADLINE MONDAY | · Jun 20, 2026 | All klue.com clients who have been contacted by us have till... |
| Klue.com | · Jun 19, 2026 | As you've probably already heard, Klue.com has been impacted... |
| thecreditpros.com | · Jun 16, 2026 | TheCreditPros' Salesforce instance was breached and 263MB of... |
| Cazh.id | · May 5, 2026 | - User DB: 300,000 Users (Email, Hash, Phone, Address, DOB) ... |
In the newsAll →
No articles mention this group yet.