Skip to main content
Darkfield

Operator dossier

Cheers is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 15 public victims claimed by this operator between May 29, 2022 and September 14, 2022. Cheers is a relatively obscure ransomware group that emerged in May 2022, primarily motivated by financial gain through extortion activities targeting organizations in the United Kingdom. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available about whether they operate as an independent entity or utilize a Ransomware-as-a-Service model. Based on their targeting patterns, Cheers appears to focus on critical infrastructure and essential services sectors, having affected approximately 15 known victims across transportation, finance, and healthcare industries primarily within the UK. Due to the group's relatively small victim count and limited public documentation by major security firms and law enforcement agencies, specific details about their attack methodology, encryption techniques, initial access vectors, and extortion tactics have not been widely reported or analyzed in available threat intelligence sources. The current operational status of the Cheers ransomware group remains unclear, as there is insufficient publicly available intelligence from reputable sources to definitively assess whether they remain active, have ceased operations, or undergone rebranding.

Most-targeted sectors

Most-affected countries

Recent disclosures by Cheers

All 15 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Cheers →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Cheers

15 victims indexed · first seen 4 years ago · last activity 4 years ago

15
Victims indexed
#186 of 364 tracked operators
4m
Active period
May 2022 → Sep 2022
1
Countries hit
top United Kingdom · 1

At a glance

Status
inactive
First seen
4 years ago
Last activity
4 years ago
Onion sites
3 known endpoints
Primary sector
Transportation · 3 hits

About

Cheers is a relatively obscure ransomware group that emerged in May 2022, primarily motivated by financial gain through extortion activities targeting organizations in the United Kingdom. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available about whether they operate as an independent entity or utilize a Ransomware-as-a-Service model. Based on their targeting patterns, Cheers appears to focus on critical infrastructure and essential services sectors, having affected approximately 15 known victims across transportation, finance, and healthcare industries primarily within the UK. Due to the group's relatively small victim count and limited public documentation by major security firms and law enforcement agencies, specific details about their attack methodology, encryption techniques, initial access vectors, and extortion tactics have not been widely reported or analyzed in available threat intelligence sources. The current operational status of the Cheers ransomware group remains unclear, as there is insufficient publicly available intelligence from reputable sources to definitively assess whether they remain active, have ceased operations, or undergone rebranding.

References

6 links

External sources curated by the MISP threat-intel community.

Timeline

5 months
2022-05-01T00:00:00+00:00 · 42022-06-01T00:00:00+00:00 · 22022-07-01T00:00:00+00:00 · 42022-08-01T00:00:00+00:00 · 32022-09-01T00:00:00+00:00 · 2
2022-05-01T00:00:00+00:002022-09-01T00:00:00+00:00

Top countries

🇬🇧 United Kingdom
1
United Kingdom dossier →

Top sectors

Transportation
3
Finance
2
Healthcare
1
Transportation dossier →Finance dossier →Healthcare dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

3 known
  • http://crkfkmrh4qzbddfrl2axnkvjp5tgwx73d7lq4oycsfxc7pfgbfhtfiid.onion
  • http://crkfkmrh4qzbddfrl2axnkvjp5tgwx73d7lq4oycsfxc7pfgbfhtfiid.onion/
  • http://rwiajgajdr4kzlnrj5zwebbukpcbrjhupjmk6gufxv6tg7myx34iocad.onion

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Cheers posts a victim.

Add Cheers to your watchlist — Pro pings you within 5 minutes of any new Cheers leak-site post, Telegram callout, or affiliate-rebrand inference.