Operator dossier

0DAY is a ransomware operator currently active on public leak sites. Darkfield has indexed 4 public victims claimed by this operator between August 16, 2026. 0DAY is a ransomware group first observed in August 2026 with an apparent financial motivation, though limited public documentation exists given its nascent operational timeline and low victim count. Based on available data, the group has claimed four known victims, with targeting concentrated in Saudi Arabia across sectors including technology and artificial intelligence, business services and outsourcing, and education and mobile applications, suggesting a degree of deliberate sector selection rather than opportunistic targeting. No attribution to a specific country of origin, RaaS affiliation, or connection to established threat actor clusters has been publicly documented by CISA, FBI, Mandiant, or other reputable security research organizations at this time. The group's attack methodology, initial access vectors, encryption tooling, and extortion tactics remain unconfirmed in open-source reporting, though the targeting of high-value technology and AI-adjacent firms is consistent with double-extortion models observed across the broader ransomware ecosystem. Given its August 2026 emergence date and small victim footprint, 0DAY should be assessed as an emerging threat actor requiring continued monitoring, as operational patterns, affiliations, and capabilities are likely to become clearer as the group matures or expands its activity.

Recent disclosures by 0DAY

All 4 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for 0DAY →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

0DAY

4 victims indexed · first seen 28 days ago · last activity 28 days ago

Victims indexed

#296 of 399 tracked operators

<1m

Active period

Aug 2026 → Aug 2026

—

Countries hit

At a glance

Status: active
First seen: 28 days ago
Last activity: 28 days ago
Onion sites: 1 known endpoint

About

0DAY is a ransomware group first observed in August 2026 with an apparent financial motivation, though limited public documentation exists given its nascent operational timeline and low victim count. Based on available data, the group has claimed four known victims, with targeting concentrated in Saudi Arabia across sectors including technology and artificial intelligence, business services and outsourcing, and education and mobile applications, suggesting a degree of deliberate sector selection rather than opportunistic targeting. No attribution to a specific country of origin, RaaS affiliation, or connection to established threat actor clusters has been publicly documented by CISA, FBI, Mandiant, or other reputable security research organizations at this time. The group's attack methodology, initial access vectors, encryption tooling, and extortion tactics remain unconfirmed in open-source reporting, though the targeting of high-value technology and AI-adjacent firms is consistent with double-extortion models observed across the broader ransomware ecosystem. Given its August 2026 emergence date and small victim footprint, 0DAY should be assessed as an emerging threat actor requiring continued monitoring, as operational patterns, affiliations, and capabilities are likely to become clearer as the group matures or expands its activity.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/0day

Recent victims

Loading recent victims

Onion infrastructure

1 known

http://odaygplp3zhyx7zl45egetl6dzc4reduisnoyym34rjdmaryfaz5doqd.onion

Source

Updated 28 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time 0DAY posts a victim.

Add 0DAY to your watchlist — Pro pings you within 5 minutes of any new 0DAY leak-site post, Telegram callout, or affiliate-rebrand inference.