Skip to main content
Darkfield

Operator dossier

Abyss is a ransomware operator currently active on public leak sites. Darkfield has indexed 103 public victims claimed by this operator between March 21, 2023 and June 7, 2026. Abyss is a relatively new ransomware group that emerged in March 2023, operating with primarily financial motivations and targeting organizations across multiple sectors with a focus on English-speaking countries. The group's origin and affiliations remain largely undocumented by major security agencies, though their targeting patterns suggest they operate independently rather than as a Ransomware-as-a-Service model. Their attack methodology and specific tools have not been extensively documented by major threat intelligence firms, though their victim profile of 87 organizations indicates they employ effective initial access techniques to compromise business services, technology, healthcare, and agriculture sectors. The group demonstrates a clear geographic preference for targets in the United States, United Kingdom, Canada, Switzerland, and Hong Kong, suggesting either language preferences or specific regional access capabilities. Due to the group's recent emergence and relatively limited public documentation from established security researchers, detailed information about notable campaigns, encryption methods, or law enforcement actions remains scarce. Abyss appears to remain active as of current reporting, though the lack of extensive public analysis by major threat intelligence organizations suggests they may operate at a smaller scale compared to more prominent ransomware families.

Most-targeted sectors

Most-affected countries

Recent disclosures by Abyss

All 103 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Abyss →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Abyss

103 victims indexed · first seen 3 years ago · last activity 1 month ago

103
Victims indexed
#75 of 364 tracked operators
3y 3m
Active period
Mar 2023 → Jun 2026
19
Countries hit
top United States · 69

At a glance

Status
active
First seen
3 years ago
Last activity
1 month ago
Onion sites
2 known endpoints
Primary sector
Business Services · 15 hits

About

Abyss is a relatively new ransomware group that emerged in March 2023, operating with primarily financial motivations and targeting organizations across multiple sectors with a focus on English-speaking countries. The group's origin and affiliations remain largely undocumented by major security agencies, though their targeting patterns suggest they operate independently rather than as a Ransomware-as-a-Service model. Their attack methodology and specific tools have not been extensively documented by major threat intelligence firms, though their victim profile of 87 organizations indicates they employ effective initial access techniques to compromise business services, technology, healthcare, and agriculture sectors. The group demonstrates a clear geographic preference for targets in the United States, United Kingdom, Canada, Switzerland, and Hong Kong, suggesting either language preferences or specific regional access capabilities. Due to the group's recent emergence and relatively limited public documentation from established security researchers, detailed information about notable campaigns, encryption methods, or law enforcement actions remains scarce. Abyss appears to remain active as of current reporting, though the lack of extensive public analysis by major threat intelligence organizations suggests they may operate at a smaller scale compared to more prominent ransomware families.

Timeline

24 months
2024-01-01T00:00:00+00:00 · 32024-02-01T00:00:00+00:00 · 62024-03-01T00:00:00+00:00 · 52024-04-01T00:00:00+00:00 · 12024-05-01T00:00:00+00:00 · 12024-06-01T00:00:00+00:00 · 42024-07-01T00:00:00+00:00 · 32024-08-01T00:00:00+00:00 · 62024-09-01T00:00:00+00:00 · 42024-10-01T00:00:00+00:00 · 62024-11-01T00:00:00+00:00 · 12024-12-01T00:00:00+00:00 · 32025-01-01T00:00:00+00:00 · 22025-02-01T00:00:00+00:00 · 32025-03-01T00:00:00+00:00 · 32025-04-01T00:00:00+00:00 · 12025-07-01T00:00:00+00:00 · 12025-09-01T00:00:00+00:00 · 22025-12-01T00:00:00+00:00 · 12026-01-01T00:00:00+00:00 · 12026-02-01T00:00:00+00:00 · 12026-03-01T00:00:00+00:00 · 52026-05-01T00:00:00+00:00 · 62026-06-01T00:00:00+00:00 · 5
2024-01-01T00:00:00+00:002026-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
69
🇬🇧 United Kingdom
5
🇺🇸 United States
5
🇨🇭 Switzerland
3
🇨🇦 Canada
3
🇩🇪 Germany
3
🇮🇹 Italy
2
Hong Kong SAR China
2
United States dossier →United Kingdom dossier →United States dossier →Switzerland dossier →

Top sectors

Business Services
15
Technology
13
Manufacturing
12
Healthcare
11
Agriculture and Food Production
5
Government
4
Construction
4
Transportation/Logistics
4
Business Services dossier →Technology dossier →Manufacturing dossier →Healthcare dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1204User Execution
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion
  • http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion/static/data.js

Source

Updated 1 month ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Abyss posts a victim.

Add Abyss to your watchlist — Pro pings you within 5 minutes of any new Abyss leak-site post, Telegram callout, or affiliate-rebrand inference.