Loading threat actor…
Settra is a ransomware and extortion threat group that emerged publicly in 2026 and rapidly appeared in ransomware claim tracking alongside other newly established brands. The group has been associated with multiple claimed compromises across North America, Europe, Africa, and Asia, including organizations in Germany, Great Britain, Taiwan, Tunisia, and the United States. Reported victims span construction, business services, e-commerce, and industrial-related organizations, including a pump manufacturer serving chemical and defense production and a diamond company. Settra has also claimed theft of internal documents and user data from a Taiwanese e-commerce subsidiary. Observed activity indicates a financially motivated cybercriminal operation centered on ransomware-linked intrusions and data theft. Publicly reported incidents attributed to Settra were described both as ransomware attacks and as data breaches, indicating use of extortion through stolen data exposure in addition to, or potentially instead of, encryption. Weekly and quarterly ransomware reporting placed Settra among newly active groups and showed it reaching a notable volume of public victim claims shortly after emergence. High-confidence reporting supports Settra’s involvement in initial compromise of victim environments, theft of data, and extortion-oriented post-compromise activity. In at least one reported case, relevant ATT&CK mappings included Valid Accounts and Data from Cloud Storage, consistent with abuse of legitimate access and exfiltration of hosted data. No high-confidence attribution to a nation state or specific country of origin is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a new entrant in quarterly rankings.
Newer ransomware/extortion actor contributing to risk in Germany.
Newly emerged ransomware/extortion group noted in June 2026.
Claimed a data breach against Pi Mobile Technology / PChome, alleging theft of internal documents and user data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.