Skip to main content
Darkfield

Operator dossier

AuditTeam (also tracked as audit team) is a ransomware operator currently active on public leak sites. Darkfield has indexed 15 public victims claimed by this operator between April 8, 2026 and June 25, 2026. AuditTeam is a relatively obscure ransomware group that emerged in April 2026 and appears to be financially motivated based on their operational patterns. The group's origin and affiliations remain unclear due to limited public documentation, though their targeting of victims primarily across China, Hong Kong, Philippines, South Korea, and Thailand suggests possible regional focus or language capabilities in Asian markets. With only five documented victims to date, AuditTeam appears to operate as a smaller-scale ransomware operation, showing particular interest in manufacturing and technology sectors alongside unspecified target types. Due to the group's recent emergence and limited scale of operations, there are no publicly documented major campaigns, high-profile victims, or significant law enforcement actions against them by agencies such as CISA, FBI, or major security research firms. The group's current operational status remains unknown given the sparse public intelligence available, and their attack methodology, encryption techniques, and extortion tactics have not been comprehensively documented by reputable security researchers as of available reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by AuditTeam

All 15 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for AuditTeam →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

AuditTeam

aka audit team · 15 victims indexed · first seen 3 months ago · last activity 20 days ago

15
Victims indexed
#186 of 364 tracked operators
2m
Active period
Apr 2026 → Jun 2026
5
Countries hit
top CN · 1

At a glance

Status
active
Aliases
audit team
First seen
3 months ago
Last activity
20 days ago
Primary sector
Not Found · 3 hits

About

AuditTeam is a relatively obscure ransomware group that emerged in April 2026 and appears to be financially motivated based on their operational patterns. The group's origin and affiliations remain unclear due to limited public documentation, though their targeting of victims primarily across China, Hong Kong, Philippines, South Korea, and Thailand suggests possible regional focus or language capabilities in Asian markets. With only five documented victims to date, AuditTeam appears to operate as a smaller-scale ransomware operation, showing particular interest in manufacturing and technology sectors alongside unspecified target types. Due to the group's recent emergence and limited scale of operations, there are no publicly documented major campaigns, high-profile victims, or significant law enforcement actions against them by agencies such as CISA, FBI, or major security research firms. The group's current operational status remains unknown given the sparse public intelligence available, and their attack methodology, encryption techniques, and extortion tactics have not been comprehensively documented by reputable security researchers as of available reporting.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-04-01T00:00:00+00:00 · 5
2026-04-01T00:00:00+00:002026-04-01T00:00:00+00:00

Top countries

🇨🇳 China
1
Hong Kong SAR China
1
🇵🇭 Philippines
1
🇰🇷 South Korea
1
🇹🇭 Thailand
1
China dossier →Hong Kong SAR China dossier →Philippines dossier →South Korea dossier →

Top sectors

Manufacturing
1
Technology
1
Manufacturing dossier →Technology dossier →

Recent victims

Loading…

Source

Updated 20 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time AuditTeam posts a victim.

Add AuditTeam to your watchlist — Pro pings you within 5 minutes of any new AuditTeam leak-site post, Telegram callout, or affiliate-rebrand inference.