Loading threat actor…
TommyLeaks is a ransomware and extortion brand associated with a Russia-linked cybercrime ecosystem tied to former Conti members. It has been identified as one of several labels used by the same broader organization during the 2021–2023 period, alongside Conti, Karakurt, Royal, SchoolBoys Ransomware, and Akira. Available reporting indicates the underlying operation conducted intrusions, stole data from victim environments, and used extortion pressure based on threatened publication or sale of stolen information. The organization affected more than 54 companies and caused losses exceeding tens of millions of dollars, with victims including businesses, government entities, and healthcare organizations. Tradecraft attributed to this broader cluster includes abuse of stolen VPN credentials for initial access, use of post-compromise tooling such as Cobalt Strike, AnyDesk, Mimikatz, and PowerShell, and data staging or exfiltration with common archive and transfer utilities. The operation has also been linked to re-extortion and follow-on extortion behavior, including renewed pressure against prior victims and attempts to leverage previously stolen data for additional payments. TommyLeaks should therefore be understood less as a distinct, fully separate actor than as a brand used within a fluid ransomware and data-extortion network overlapping with Karakurt, Royal, and other Conti-derived operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One of the extortion brands used by the broader ransomware organization tied to former Conti leaders.
Referenced as an extortion/ransomware group associated with attacks against victim organizations.
Named as a ransomware group used as a false attribution in the follow-on extortion narrative; no direct activity details provided beyond being cited as the (incorrect) original compromise actor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.