Loading threat actor…
Weyhro is an emerging ransomware and extortion threat group first observed in March 2024. It has been tracked among the newer ransomware variants that expanded the fragmented ransomware ecosystem in 2024 and remained active into 2025. Reporting associates Weyhro with a shift toward pure extortion operations that forgo file encryption, indicating a data-theft-led pressure model rather than traditional locker-based ransomware. Weyhro has also been noted in victim-leak-site activity and in discussions of recycled or reposted victim claims by other ransomware actors, indicating its leak disclosures have been visible enough to be reused by peers. Weyhro has been observed in the broader ransomware landscape affecting organizations across multiple sectors, with available victim examples indicating activity against financial services, industrial and manufacturing-related organizations, construction, legal services, real estate, and social or community services. The group is part of the broader trend of newer ransomware brands using extortion-centric operations and public victim shaming to pressure targets. High-confidence public reporting does not provide sufficient detail to attribute Weyhro to a specific country, identify a formal ransomware-as-a-service structure, or confirm a broader malware/tooling set beyond its encryption-less extortion posture.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named ransomware/extortion group referenced as the original source of some victims that LockBit 5.0 allegedly recycled.
Named as a new ransomware variant/gang emerging in 2024 and associated with victim claims posted in March 2024.
Emerging ransomware/extortion group mentioned as adopting a pure extortion approach (ditching encryption).
Emerging ransomware group listed as active in Q1 2025.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.