Loading threat actor…
PEAR, also expanded as Pure Extraction and Ransom, is a ransomware and cyber-extortion group that emerged in mid-2025. The group is notable for operating as a data-theft-focused extortion actor rather than a conventional encrypting ransomware operation, using a leak site to pressure victims and threatening publication of stolen information unless ransom demands are met. Reporting associates PEAR with numerous publicly claimed victims and unusually large claimed data theft volumes, including incidents in healthcare, financial services, technology, manufacturing, construction, logistics, and nonprofit organizations. PEAR has been linked to intrusions against U.S.-based healthcare and healthcare-adjacent organizations such as Medical Computer Business Services and Expert MRI, where it claimed large-scale exfiltration of sensitive personal and medical data. It has also claimed attacks against organizations in mortgage lending, manufacturing, IT services, construction, distribution, and community services. Public reporting indicates the group listed more than 100 alleged victims on its leak site by 2026 and was identified as an emerging or returning extortion actor in broader ransomware ecosystem tracking. The group’s tradecraft, as directly supported by available reporting, centers on unauthorized network intrusion, data exfiltration, operation of a leak site, and extortion through threatened public release of stolen data. Multiple reports explicitly characterize PEAR as focused on data theft only, without file encryption, placing it among extortion actors that rely on stolen-data leverage rather than operational disruption from locked systems. Claimed victim data sets have included financial records, human resources material, business documents, emails, databases, and protected health information. PEAR appears financially motivated, with its operations aligned to cyber extortion for ransom payment. No high-confidence attribution to a nation-state or specific country of origin is established in the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Claimed responsibility for the cyber attack on MCBS, allegedly exfiltrated 3.3 TB of confidential data, and threatened to publish the stolen database unless ransom demands were met.
Claimed responsibility for the MCBS breach and alleged exfiltration of 3.3 terabytes of data, later stating the data was fully leaked online.
An emerging or returning ransomware group identified in the report.
Ransomware and data theft/extortion operations targeting organizations including healthcare-related entities; claimed the MCBS intrusion and publication of allegedly stolen data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.