Loading threat actor…
Morpheus is a ransomware and data-extortion operation active by at least 2025 and 2026. It has been observed claiming victims through a leak site and directly threatening organizations with publication of stolen data, indicating an extortion model centered on exfiltration and public shaming. Reported victims span multiple sectors and countries, including financial services, information technology, industrial and manufacturing-related organizations, and professional or business services in India, the United States, Singapore, and South Korea. Morpheus has been linked to the HellCat ransomware operation through analysis showing the two brands deployed effectively identical ransomware binaries, differing only in branding-related elements. This suggests either shared operators, shared tooling, or a white-label or rebranding relationship that complicates attribution at the brand level. Morpheus has also been identified among emerging ransomware groups observed in the 2025 threat landscape. The group’s operations include victim listing on a dark web leak site, claims of large-scale data theft, and coercive deadlines intended to force victim engagement. In the HDFC Asset Management Company incident, Morpheus claimed to have exfiltrated a large volume of data and later listed the victim on its leak site, consistent with data-theft extortion. Public reporting around that intrusion indicates compromise of enterprise infrastructure and suggests post-compromise activity compatible with lateral movement, defense evasion, and staged exfiltration, although the precise initial access vector was not publicly confirmed. Morpheus is best characterized as a financially motivated cybercriminal ransomware actor. No high-confidence evidence in the available facts supports attribution to a specific state sponsor or country of origin.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a ransomware attack resulting in a data breach against Yue Ki Industrial, a manufacturing company.
Conducting a ransomware attack against Kyowa Singapore Pte Ltd.
Named as a data extortion actor claiming theft of a large volume of data from a financial-sector organization.
Conducting a ransomware attack resulting in a data breach against Hansa Research Group Pvt. Ltd.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.