ZeroHour

ransomhub

Ransomware / extortion group tracked from leak-site posts

Victims · 7d
0flat
Victims · 30d
0active targets
Victims · 90d
0
All-time (tracked)
868since 2024-02-10
Last post
04-01 00:29UTC
Estimated earnings
public reporting
Profile not written yet: the pipeline profiles the most active groups first, a few per run.

Leak-site victims

VictimDiscoveredDetails
bpjaguar.com · Jul 26, 2024
oficina.oficinadasfinancas.com.br · Jul 26, 2024
mrhme.org · Jul 25, 2024
panitchlaw.com · Jul 25, 2024
cminsulation.com · Jul 25, 2024
baytoti.com · Jul 25, 2024
sigmacontrol.eu · Jul 23, 2024
www.byzan.com · Jul 23, 2024
www.garudafood.com · Jul 20, 2024
www.kumagaigumi.co.jp · Jul 20, 2024
www.glowfm.nl · Jul 19, 2024
www.erma-rtmo.it · Jul 18, 2024
metalfrio.com.br · Jul 18, 2024
www.newcastlewa.gov · Jul 18, 2024
pgd.pl · Jul 18, 2024
www.hlbpr.com · Jul 17, 2024
ceopag.com.br / ceofood.com.br · Jul 16, 2024
www.benchinternational.com · Jul 16, 2024
www.cameronhodges.com · Jul 16, 2024
eni.com&mellitahog.ly · Jul 13, 2024
www.zepter.de · Jul 12, 2024
www.riteaid.com · Jul 12, 2024
www.netavent.dk · Jul 11, 2024
www.lynchaluminum.com · Jul 11, 2024
www.eurostrand.de · Jul 11, 2024
www.bfcsolutions.com · Jul 11, 2024
baiminstitute.org · Jul 6, 2024
hcri.edu · Jul 4, 2024
midamea.com<Auction> · Jul 3, 2024
aedifica.com · Jul 3, 2024
www.swcs-inc.com · Jul 3, 2024
www.daesangamerica.com · Jul 2, 2024
www.finecopneumatica.com · Jul 2, 2024
www.hauptmann.at · Jul 2, 2024
www.sfmedical.de · Jul 2, 2024
floridahealth.gov · Jul 2, 2024
www.nttdata.ro · Jul 2, 2024
www.sicoob.com.br<Updated> · Jun 30, 2024
Spandex.com · Jun 29, 2024
midamea.com · Jun 28, 2024
equinocioplay.com.br · Jun 27, 2024
www.cipl.org.in · Jun 27, 2024
www.mangimifusco.it · Jun 27, 2024
www.cloudeurope.it · Jun 27, 2024
coca-cola.com - Myanmar office · Jun 27, 2024
daniellegroup.com · Jun 27, 2024
www.harrisranchbeef.com · Jun 25, 2024
multi-wing.com · Jun 24, 2024
bitzsoftwares.com.br · Jun 24, 2024
www.sicoob.com.br · Jun 24, 2024

In the newsAll →

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .