Abyss is a ransomware operator currently active on public leak sites. Darkfield has indexed 98 public victims claimed by this operator between March 21, 2023 and May 18, 2026. Abyss is a relatively new ransomware group that emerged in March 2023, operating with primarily financial motivations and targeting organizations across multiple sectors with a focus on English-speaking countries. The group's origin and affiliations remain largely undocumented by major security agencies, though their targeting patterns suggest they operate independently rather than as a Ransomware-as-a-Service model. Their attack methodology and specific tools have not been extensively documented by major threat intelligence firms, though their victim profile of 87 organizations indicates they employ effective initial access techniques to compromise business services, technology, healthcare, and agriculture sectors. The group demonstrates a clear geographic preference for targets in the United States, United Kingdom, Canada, Switzerland, and Hong Kong, suggesting either language preferences or specific regional access capabilities. Due to the group's recent emergence and relatively limited public documentation from established security researchers, detailed information about notable campaigns, encryption methods, or law enforcement actions remains scarce. Abyss appears to remain active as of current reporting, though the lack of extensive public analysis by major threat intelligence organizations suggests they may operate at a smaller scale compared to more prominent ransomware families.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.