M3RX

m3rx is a ransomware threat actor active in 2026 that publicly claimed intrusions against organizations across multiple regions, including North America, Europe, Latin America, Africa, Asia-Pacific, and Australia. Reported victims span technology, manufacturing, transportation and logistics, professional and business services, hospitality, legal services, consulting, and managed security services. Multiple incidents attributed to m3rx included claims of substantial data theft, indicating that exfiltration is a recurring component of its operations in addition to ransomware deployment. Observed victimology shows broad opportunistic targeting rather than a narrowly specialized sector focus. Reported victims include software development firms, industrial component suppliers, electrical equipment manufacturers serving mining and tunneling, freight and logistics providers, property and construction consultancies, hospitality groups, legal firms, forestry and land-management consultancies, and security service providers. Publicly claimed incidents indicate operations against organizations in the United States, Canada, Mexico, Brazil, Portugal, Germany, the United Kingdom, Norway, South Africa, Taiwan, Australia, Ireland, and Argentina. The available evidence supports characterization of m3rx as a financially motivated ransomware actor engaged in extortion through compromise of enterprise environments and theft of victim data. Public reporting tied to its claimed attacks consistently describes ransomware incidents and, in many cases, explicitly states that data was stolen from victims. No high-confidence information is available here on the group’s origin, affiliate structure, malware lineage, leak-site branding beyond the actor name, or distinctive tradecraft such as specific initial access vectors, persistence mechanisms, privilege-escalation methods, or lateral-movement techniques.