ransomexx
ransomware group · aka RansomEXX, Ransom X, REX, Defray777 · unknown · active since 2018 (as Ransom X/Defray777); RansomEXX branding reported from 2020
Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
1
All-time (tracked)
70since 2021-09-09
Last post
06-20 16:53UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
RansomEXX (also tracked as Ransom X, REX, and Defray777) is a double-extortion ransomware family observed since 2018 and notable for releasing one of the first widely covered Linux encryption variants in mid-2020. Publicly reported victims include the Texas Department of Transportation and Konica Minolta, both in 2020. Proofpoint tracks the associated threat actor as TA1650, which has also been observed deploying the Monti (Mirai-variant) botnet alongside ransomware on Linux hosts. Vendor research (Trend Micro, 2021) documented use of the FortiOS vulnerability CVE-2018-13379 for initial access, and IBM reported use of ZeroLogon (CVE-2020-1472) for privilege escalation in the Defray777 era. Per this dashboard's tracking, current leak-site activity is low, with one victim listed in the past 90 days and the most recent post on 2026-06-20.
Tactics & tooling
- Double-extortion model: encryption combined with publication on a dedicated leak site
- Windows and Linux encryption binaries, including an early prominent Linux variant (2020)
- Initial access via Fortinet FortiOS CVE-2018-13379 (vendor reporting, 2021)
- Privilege escalation using ZeroLogon (CVE-2020-1472) (vendor reporting, 2020)
- Hands-on-keyboard intrusions linked to the actor tracked as TA1650 (Proofpoint)
- Observed deploying Monti, a Mirai-variant botnet, on compromised Linux hosts alongside ransomware (Proofpoint, 2022)
Targeted sectors
GovernmentTransportationTechnology & ManufacturingHealthcareFinancial & Professional Services
Notable public victims
Texas Department of Transportation (TxDOT), 2020 (public reporting), Konica Minolta, 2020 (public reporting), Lite-On Technology (LITEON), listed on group leak site (dashboard tracking), Go2Joy, listed on group leak site (dashboard tracking), ADDA, listed on group leak site (dashboard tracking), nursing.com, listed on group leak site (dashboard tracking), SOGO Auction, listed on group leak site (dashboard tracking)
CVEs linked to their intrusions
Estimated earnings
No public figure.
Leak-site victims70 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Go2Joy (go2joy.vn) | · Jun 20, 2026 | We have released the complete database of Go2Joy, Vietnam’s leading platform for hourly and short-stay hotel bookings. |
| SOGO Auction | · Apr 17, 2026 | SOGO Auction - 951MB leaked. SOGO Auction is a prominent Japan-based, specialized auctioneer with over 30 years of experience in trading used construction machinery and heavy equipment. Operating since the 1990s, they provide both on-site and online, high-volume auctions for items like excavators and bulldozers. It is operated by SOGO Corporation. |
| GoTip | · Apr 16, 2026 | GoTip - 1.13GB leaked. Gotip.jp is a Japanese live-streaming enhancement tool that connects digital tips (donations) to physical Bluetooth-enabled devices. It allows viewers to support creators by sending tips, which in turn trigger actions on devices owned by the creator, aimed at making live streams more interactive and engaging. |
| Grupo Vargas | · Mar 9, 2025 | Laboratorios Vargas stands out in the pharmaceutical sector, not just for its longevity but also through continuous innovation and dedication toward creating high-quality medications tailored to meet diverse healthcare needs. Leak size: 37.6GB. |
| ADDA (adda.io) | · Mar 9, 2025 | ADDA is SaaS for Residential Community Management. 12 millions residents, visitors and stuff records leaked. |
| Makesworth Accountants | · Feb 9, 2025 | Makesworth Accountants is multi-award-winning accountancy practice of a chartered accountant, tax and business advisers. |
| Lakeshore Title Agency | · Feb 3, 2025 | Date: Fri 31 January 2025 Tags: #usa Lakeshore Title Agency has closed over $100 million in commercial transactions and over $700 million in residential refinances and purchases. |
| Retemex | · Sep 14, 2024 | Retemex is a virtual mobile operator in Mexico, operating on the country’s 4.5G LTE network. 24883 clients data even with PLAINTEXT PASSWORDS! |
| Brontoo Technology Solutions | · Aug 10, 2024 | OstaApp, developed by Brontoo Technology Solutions India Private Limited, is a digital payment platform designed to offer a secure, fast, and convenient way to make transactions without relying on traditional cards, wallets, or point-of-sale (POS) systems. The platform generates a unique, one-time-use digital number or QR code, which users can utilize for payments at registered merchants, partner ATMs, and more. Database with 146123 users leaked. Proof of PCI DSS compliance is not a guaranteed solution. |
| nursing.com | · Aug 3, 2024 | NURSING.com is an all-in-one online platform designed to help nursing students succeed in their studies and pass the NCLEX® exam with confidence. It provides a variety of resources, including video lessons, practice questions, cheat sheets, and custom study plans tailored to individual learning needs. The platform is particularly beneficial for visual learners, students with ADHD, dyslexia, and those who experience anxiety. Database dump, 568221 users. |
| Planet Group International | · Jul 26, 2024 | Planet Group International is a multinational corporation specializing in innovative technology solutions and consulting services. With a presence in numerous countries, the company focuses on digital transformation, IT infrastructure, software development, and data analytics. They cater to a diverse range of industries, providing tailored solutions to enhance operational efficiency and drive business growth. Planet Group International is known for its commitment to excellence, leveraging cutting-edge technologies to deliver high-quality services and support to its global clientele. Leaked data size: 4.9GB. |
| LITEON | · Jul 26, 2024 | LITEON Technology Corporation, based in Taiwan, is a leading company in the electronics industry known for its diverse range of products. Founded in 1975, LITEON specializes in the development and manufacturing of optoelectronics, storage devices, and other electronic components. Its products include LED lighting solutions, semiconductors, automotive electronics, and smart healthcare devices. LITEON is recognized for its innovation and commitment to sustainability, providing high-quality technology solutions to global customers while emphasizing environmental responsibility. Leaked data size: 142GB. |
| Wagner-Meinert | · Jul 12, 2024 | Wagner-Meinert is a company that specializes in industrial refrigeration, food process systems, and mechanical contracting. They provide services such as design, installation, maintenance, and compliance support for industrial and commercial refrigeration systems. Their expertise often spans areas including ammonia refrigeration systems, food processing equipment, HVAC systems, and related industrial solutions. Leaked data size: 685.3GB. |
| TUV Rheinland AG | · Jul 1, 2024 | Post will be available soon… Leaked data size: 650GB. |
| Asteco | · Apr 17, 2024 | Asteco is a real estate services firm based in the United Arab Emirates (UAE), with its headquarters in Dubai. It offers a wide range of real estate services including property management, valuation, research, investment consultancy, and sales and leasing brokerage. Asteco has been a prominent player in the UAE’s real estate market for several years, providing services to both individual clients and corporate entities. Leaked data size: 11.4GB. |
| Badan Urusan Logistik | · Mar 26, 2024 | BULOG, or Badan Urusan Logistik, is the state-owned logistics agency of Indonesia. Leaked data size: 12.77GB. |
| Jacobs Farm / Del Cabo | · Mar 26, 2024 | Jacobs Farm / Del Cabo is an organic farming company known for its commitment to sustainable agriculture and ethical business practices. Leaked data size: 399GB. |
| DVision Architecture | · Mar 26, 2024 | Dvision Architecture is a global architecture and design firm known for its innovative approach to architectural projects. Leaked data size: 110GB. |
| Telecommunications Services of Trinidad and Tobago | · Mar 26, 2024 | Telecommunications Services of Trinidad and Tobago (TSTT) is the primary telecommunications provider in the twin-island nation of Trinidad and Tobago. Leaked data size: 6GB. |
| Ministry of Defense of Peru | · Mar 26, 2024 | The Peruvian Ministry of Defense (Ministerio de Defensa del Perú) is the government agency responsible for overseeing the defense and security affairs of Peru. Leaked data size: 763.8GB. |
| Kenya Airways | · Dec 30, 2023 | Kenya Airways Ltd., more commonly known as Kenya Airways, is the flag carrier airline of Kenya. The company was founded in 1977, after the dissolution of East African Airways. Its head office is located in Embakasi, Nairobi, with its hub at Jomo Kenyatta International Airport. Accidents, IDs, cases, passports, staff death, etc. |
| AlJaber Engineering | · Nov 26, 2023 | AlJaber Engineering (JEC) is a leading general contractor based in the State of Qatar. |
| Admilla ELAP | · Nov 16, 2023 | Elap (formerly Admilia) offers its expertise and support throughout the implementation of your budget and accounting solution. Huge clients, financial documents, contracts, personal data and a lot of confidential things belongs to their customers. If you wanna be one someday your data will be here. |
| Telecommunications Services of Trinidad and Tobago (tstt.co.tt) | · Oct 27, 2023 | tstt.co.tt and bmobile.co.tt. 4293368 customer's lines, ID scans, gitlab projects, db dumps. |
| DVA - DVision Architecture | · Jul 1, 2023 | Dalla digitalizzazione del progetto alla realizzazione di prototipi costruttivi: l’attività di DVA spazia dal concept di un intervento, all’organizzazione logistica di cantiere. Un approccio declinato secondo il connubio tra digitalizzazione e sostenibilità, orientamento cardine di tutte le scelte della società e rintracciabile in ognuna delle commesse prese in carico. |
| Jacobs Farm | · Jun 24, 2023 | Jacobs Farm was founded in 1980 as a small organic family farm dedicated to growing fresh, high quality, delicious food without damaging the environment. |
| Bettuzzi And Partners | · Mar 2, 2023 | Lo Studio BETTUZZI & PARTNERS - Dottori Commercialisti è stato fondato dal dott. Alvaro Bettuzzi, nell'anno 2005, dopo aver maturato significative esperienze nello svolgimento della professione di dottore commercialista. Oltre al contributo del fondatore, lo Studio si avvale della collaborazione di altri dottori commercialisti, di esperti professionisti in altre discipline, di docenti universitari e di specialisti in varie aree della consulenza, soprattutto in materia legale e fiscale, in ambito sia nazionale che internazionale. |
| BULOG | · Feb 22, 2023 | BULOG adalah perusahaan umum milik negara yang bergerak di bidang logistik pangan. |
| REC Silicon | · Dec 11, 2022 | REC Silicon is a global leader in silane-based, high-purity silicon materials. |
| Unimed Belem | · Oct 18, 2022 | A Unimed é a maior realidade cooperativista na área da saúde em todo o mundo e também a maior rede de assistência médica do Brasil, presente em 83% do território nacional. O Sistema nasceu com a fundação da Unimed Santos (SP) pelo Dr. Edmundo Castilho, em 1967, e hoje é composto por 368 cooperativas médicas, que prestam assistência para mais de 19 milhões de clientes e 73 mil empresas em todo País. Clientes Unimed contam com mais de 110 mil médicos, 3.244 hospitais credenciados, além de pronto-atendimentos, laboratórios, ambulâncias e hospitais próprios e credenciados para garantir qualidade na assistência médica, hospitalar e de diagnóstico complementar oferecidos. |
| Consorci Sanitari Integral & Geseme | · Oct 11, 2022 | El Consorci Sanitari Integral (CSI) és un ens públic de serveis sanitaris i socials que neix l'any 2000 assumint els antics hospitals de la Creu Roja en la província de Barcelona. Actualment, el CSI està participat pel Servei Català de la Salut, l'Institut Català de la Salut, l'Ajuntament de l'Hospitalet de Llobregat, l'Ajuntament de Sant Joan Despí, el Consell Comarcal del Baix Llobregat i la Creu Roja. En 2016 en fou nomenat director general Carles Constante i Beitia. |
| Ferrari | · Oct 3, 2022 | Some internal documents, datasheets, repair manuals, etc. |
| Bombardier Recreational Products (BRP) - SOURCE CODES | · Oct 1, 2022 | Here are some codes from BRP's repos. atgk.brp.ApprenticeShopAPI, atgk.brp.ApprenticeShopMobileAppBackend, atgk.brp.Tools.RemoteConnectionManager, BRP - Usine 9 - Tracking, BRP-PP-ALM, EPC, RIM, SAP-BenchStatusMobileApp. |
| Fundo Nacional de Desenvolvimento da Educação | · Sep 3, 2022 | The National Fund for Educational Development (FNDE) is a federal agency under the Ministry of Education, responsible for implementing programs nationwide, including the National School Nutrition Program – PNAE, which serves 47 million students throughout the country, offering adequate and safe food in schools. Since its establishment, the FNDE has undergone several changes, which became more intense when the Brazilian government laid the groundwork for the formation of a substantive conception of education that pervades all levels of education and procedures. Thus, the agency was strengthened, especially with regard to the ongoing management of activities, projects and educational programs as a strategy to support the promotion of educational quality. Nowadays, besides the National School Nutrition Program - PNAE, the FNDE is responsible for implementing the Programs of School Transportation, National Textbook, School Direct Money, Brazil Literate, Pro-Youth, Joint Action Plan, Pro-Child, Decentralization and the Open University Credits. |
| Bombardier Recreational Products (BRP) - BONUS CONTENT (!!!) | · Aug 24, 2022 | In addition to previous leak: employees credentials, if you need netflix, battle.net, paypal or pornhub account feel free to use it; employees personal photos/videos; confidential BRP documents from several employees desktops/laptops. Why it's posted separately? They forces us to increase damage of the attack due to their "negotiations team". |
| Bombardier Recreational Products (BRP) | · Aug 23, 2022 | BRP Inc. is the holding company for Bombardier Recreational Products Inc., operating as BRP, a Canadian manufacturer of snowmobiles, all-terrain vehicles, side by sides, motorcycles, and personal watercraft. It was founded in 2003, when the Recreational Products Division of Bombardier Inc. was spun-off and sold to a group of investors consisting of Bain Capital, the Bombardier-Beaudoin family and the Caisse de dépôt et placement du Québec. Bombardier Inc., was founded in 1942 as L'Auto-Neige Bombardier Limitée (Bombardier Snowmobile Limited) by Joseph-Armand Bombardier at Valcourt in the Eastern Townships, Quebec. As of October 6, 2009, BRP had about 5,500 employees; its revenues in 2007 were above US$2.5 billion. BRP has manufacturing facilities in five countries: Canada, the United States (Wisconsin, Illinois, North Carolina, Arkansas, Michigan and Minnesota), Mexico, Finland, and Austria. The company's products are sold in more than 100 countries, some of which have their own direct-sales network. BRP's products include the Ski-Doo and Lynx snowmobiles, Can-Am ATVs and Can-Am motorcycles, Sea-Doo personal watercraft, and Rotax engines. The Ski-Doo was ranked 17th place on CBC Television's The Greatest Canadian Invention in 2007. Confidential agreements, NDA's, personal data, passports, etc. |
| Liberty Group & ForHousing | · Aug 18, 2022 | ForHousing formerly City West Housing Trust (CWHT) is a housing association in the City of Salford district. ForHousing is part of the Forviva Group with their head office in Eccles, Greater Manchester. Their homes were previously owned by Salford City Council until 2008 when they were stock transferred across to the new entity. ForHousing owns, and maintain over 14,600 homes. Colette McKune is the Group Chief Executive and Andy Zuntz is the chairman. |
| Sonae | · Apr 5, 2022 | Food Retail Market Leader in Portugal |
| Stago | · Mar 29, 2022 | Diagnostica Stago, Inc., (DSI) is an industry leader in the science of hemostasis and thrombosis. Stago provides the total commitment of global resources and responsiveness, coupled with cutting edge technology and reliability. DSI is dedicated to continually developing and providing the very best hemostasis products, technical support, and services. Firmware source codes inside. |
| Scottish Association for Mental Health | · Mar 20, 2022 | — |
| Viva Air | · Mar 15, 2022 | Fast Colombia S.A.S., trading as Viva Air Colombia and formerly VivaColombia, is a Colombian low-cost airline based in Rionegro, Antioquia, Colombia. It is a subsidiary of Irelandia Aviation and third largest airline in the country. It is not legally affiliated with Mexico's VivaAerobús, a fellow low-cost carrier co-founded by Irelandia which also uses the "Viva" brand. 26.5 million of client's names/dob's/passport numbers/phones/mails and a lot of other things inside. |
| POP TV | · Feb 15, 2022 | Pro Plus is a Slovenian multimedia company (d.o.o.) for television management, television productions, films of international studios, and sales of television advertising time. Pro Plus operates the commercial television programs Pop TV, Kanal A, Brio, Oto and Kino, the media web site 24ur.com, the specialized web sites Zadovoljna.si, Bibaleze.si, Cekin.si, Vizita.si, Frendi and Flirt, Moškisvet.com, Okusno.je and Dominvrt.si. Casting applicants (21K+) personal data, CV's, videos, photos, crew personal data. |
| KCA Deutag | · Jan 28, 2022 | With over 130 years of experience, KCA Deutag is a leading drilling, engineering and technology company working onshore and offshore with a focus on safety, quality and operational performance. They operate approximately 110 drilling rigs in 20 countries. KCA Deutag's corporate headquarters are in Aberdeen where the Land, Offshore and RDS divisions operate from. Bentec is headquartered at its manufacturing facility in Bad Bentheim, Germany. POSITIVE DRUG TESTS, COVID UNVACCINATED EMPLOYEES, CREDENTIALS and a lot of fun inside. |
| Hellmann Worldwide Logistics | · Dec 15, 2021 | — |
| UMW Group | · Dec 10, 2021 | The UMW Group is a leading industrial conglomerate and one of Malaysia's foremost public-listed companies. |
| Ruwac | · Dec 6, 2021 | Since 1985, Ruwac Industrial Vacuums has been manufacturing portable, central, silo and specialty industrial vacuum cleaner systems. |
| Unione dei Comuni Terre di Pianura | · Nov 16, 2021 | L'Unione dei comuni Terre di Pianura è un ente locale costituito nel gennaio 2010. Nasce dalla precedente esperienza di associazione intercomunale costituitasi nel 2000 con il nome di “Associazione Terre di Pianura”. |
| Digicel Group | · Oct 24, 2021 | Digicel is a Caribbean mobile phone network and home entertainment provider operating in 33 markets across the Worldwide regions. The company is owned by Irish businessman Denis O'Brien, is incorporated in Bermuda, and is headquartered in Jamaica. |
| Unione Reno Galliera | · Sep 26, 2021 | L'Unione Reno Galliera è una unione di comuni che nasce dall'accordo tra otto comuni italiani della città metropolitana di Bologna. Il loro territorio, costeggiato dal fiume Reno, si estende a nord del capoluogo, sviluppandosi verso Ferrara. Ne fanno parte Argelato, Bentivoglio, Castello d'Argile, Castel Maggiore, Galliera, Pieve di Cento, San Giorgio di Piano, San Pietro in Casale. |
| United Carton Industries Company Ltd | · Sep 20, 2021 | United Carton Industries Company (UCIC) has been in the corrugated business since 1990 with a current annual capacity of 420,000 tonnes. UCIC focuses on high quality corrugated solutions for the customized packaging needs.Five state of the art plants produce corrugated boxes, point of sale material, shelf ready and high graphic packaging. Strategically positioned in Jeddah and Riyadh, catering to the corrugated needs of FMCG, white goods, agricultural and packaging companies which includes the largest multi-national corporations and the best of domestic industry. |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .