Loading threat actor…
RansomedVC, also styled Ransomed.vc or Ransomed, is a cybercriminal data-extortion operation that emerged prominently in 2023 and has been tracked in ransomware leak-site reporting despite limited evidence that it operated a proprietary encryptor. The group is best characterized as a leak-and-extort actor focused on stealing, acquiring, or repackaging data and pressuring victims with publication threats rather than confirmed large-scale ransomware encryption. It has been associated with public victim claims against organizations in technology, telecommunications, and insurance, and has advertised stolen data on criminal forums. Multiple assessments describe the actor as prone to exaggeration or fabrication, with some victim claims assessed as fictitious and used to coerce payment or build notoriety. Reporting has also linked the actor behind the operation to the name RansomedSupport. RansomedVC has used dark-web leak sites, Telegram channels, criminal forums, and direct public branding to support extortion and affiliate-style activity. Its coercion model has included explicit use of GDPR-related pressure against organizations handling personal data, particularly in Europe, by implying that payment may be less costly than regulatory exposure following a breach. The group has claimed a concentration on North American and especially European Union targets, with reporting indicating an unusually high share of listed victims in the EU compared with broader ransomware trends. The operation has shown overlap or alignment with a broader cybercrime ecosystem involving Stormous and later GhostLocker branding. Investigations identified continuity across shared communications methods, Telegram-channel rebrands, onion-service infrastructure, affiliate onboarding mechanisms, victim-management workflows, and negotiation processes. This relationship is better understood as gradual operational convergence within a shared ecosystem than as a simple one-time rebrand. The ecosystem around RansomedVC and Stormous has included structured affiliate rules, tiered participation models, victim submission processes, negotiation support, and restricted backend panels, indicating organized extortion operations even where specific breach claims were not always credible. RansomedVC has been observed conducting data publication and sale activity, exfiltration-centered extortion, affiliate recruitment, and public leak-site operations. It has also been cited as an example of deceptive behavior in the ransomware ecosystem, including fabricated attack claims and use of purchased, recycled, or otherwise non-exclusive data. The group reappeared after a period of inactivity and has remained relevant in dark-web leak-site monitoring and ransomware ecosystem reporting.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware/extortion brand that evolved through Telegram-based recruitment, breach announcements, marketplace promotion, DDoS offerings, and partnerships, later converging operationally with the Stormous ecosystem.
Referenced as a ransomware/extortion group known for listing fabricated attacks on leak sites to deceive/pressure victims.
Referenced as a ransomware group known (in this context) for listing fabricated attacks on leak sites to deceive/pressure victims.
Extortion/scam actor cited for making false claims of data theft (fictitious stolen data) to pressure organizations into paying, as part of its business strategy.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.