Loading story…
Threat intelligence researchers reported that a newly surfaced actor calling itself 0APT/0apt launched a dark web “leak site” and rapidly posted a large set of purported victims—mixing real brand names with clearly fabricated entities—which triggered incident-response activity at some named organizations. S-RM assessed the operation as an impostor ransomware effort, noting examples of obviously fictional victims (including names suggestive of LLM-generated or pop-culture-derived entities) and warning that the scale and sector spread of the claimed victim list is atypical even for major historical campaigns.
Independent analysis cited by DataBreaches.net similarly concluded the “leaks” are not stolen data: downloads linked from the site reportedly produce endless streams of random bytes rather than exfiltrated files, consistent with piping a randomness source such as /dev/random to visitors. Both write-ups assess the activity as a scam or deception operation—potentially to pressure listed companies into paying, waste defenders’ time, or lure other criminals—advising organizations named on the site to validate claims with due diligence and respond proportionately rather than initiating large-scale technical remediation solely based on the postings.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that 0apt's posted 'leaks' do not contain stolen data. Instead, the download links appear to stream effectively endless randomly generated data, likely /dev/random output, suggesting the operation is intended to waste analysts' time and trigger panic rather than publish exfiltrated files.
A new dark web leak-site group calling itself 0apt began posting numerous victim listings, including major recognizable companies, creating the appearance of a broad ransomware or extortion campaign. The references do not provide a specific launch date, so this is inferred from the first reporting on the activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers assessed a purported ransomware operation calling itself **0APT** and found indicators it may be a scam rather than an active extortion group. The actor launched a data-leak site in late January and rapidly posted **200+ claimed victims** within about a week—an unusually high tempo that often suggests a rebrand or splinter group, prompting closer scrutiny by GuidePoint Security. Reporting indicates the 0APT narrative quickly unraveled after online observers flagged that many listed victims appeared **fake** (potentially AI-generated names). The group then took its leak site offline, later relaunching it with **a smaller list of real organizations**, but researchers said **none of the alleged compromises have been substantiated**; in at least two cases, organizations that conducted incident response investigations reportedly found **no evidence of a breach**. The operation also reportedly required a **bitcoin “joining fee” for affiliates**, reinforcing concerns that the brand is being used to monetize would-be partners rather than to conduct verified ransomware intrusions.
Jun 29, 2026
A new ransomware operation calling itself **0APT** surfaced on dark web infrastructure in early 2026, promoting itself as a *ransomware-as-a-service (RaaS)* and claiming it had breached **200+ organizations** in a very short period. Multiple investigations found the victim list and “leak” materials to be largely **non-credible**, including listings for apparently fictional entities and public denials from named organizations that they had been compromised. Researchers assessed the campaign as primarily designed to **create the illusion of mass breaches** to attract or defraud would-be affiliates rather than to extort confirmed victims. Technical review of 0APT’s infrastructure described an onion-based leak site and a RaaS panel that allowed affiliates to generate limited numbers of ransomware builds and advertised multi-platform targeting (including **Windows, Linux, and macOS**), with Windows payloads described as **Rust-based**. The “downloadable” leak content showed suspicious behavior—claimed dataset sizes that did not align with the presented file trees and downloads that failed to complete in practical time—along with a lack of preview evidence (e.g., screenshots) typically used by established ransomware groups to prove exfiltration. While the public-facing campaign appeared to be a **bluff**, researchers cautioned that the presence of functioning RaaS tooling could still enable the operators to evolve into a more operational threat if they successfully recruit affiliates.
Jun 29, 2026
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026