Skip to main content
Darkfield

Operator dossier

datacarry (also tracked as DATA CARRY) is a ransomware operator currently active on public leak sites. Darkfield has indexed 16 public victims claimed by this operator between May 26, 2025 and December 6, 2025. Datacarry is a newly emerged ransomware group first observed in May 2025, appearing to be financially motivated based on their targeting patterns across multiple industry sectors. The group's origin and operational structure remain largely undocumented by major threat intelligence organizations, with no confirmed country of origin or known affiliations to established ransomware families reported by CISA, FBI, or leading security researchers. Limited public documentation exists regarding their specific attack methodologies, encryption techniques, or whether they employ data exfiltration tactics prior to encryption. The group has claimed at least 16 victims across European nations including Belgium, Sweden, Spain, Italy, and Latvia, with their targeting spanning consumer services, financial services, healthcare, and transportation/logistics sectors. Given the recent emergence of this threat actor in May 2025, datacarry appears to remain active, though comprehensive threat intelligence profiles from established security organizations have not yet been published due to the group's nascent operational timeline.

Most-targeted sectors

Most-affected countries

Recent disclosures by datacarry

All 16 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for datacarry →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

datacarry

aka DATA CARRY · 16 victims indexed · first seen 1 year ago · last activity 7 months ago

16
Victims indexed
#174 of 364 tracked operators
7m
Active period
May 2025 → Dec 2025
12
Countries hit
top Spain · 2

At a glance

Status
active
Aliases
DATA CARRY
First seen
1 year ago
Last activity
7 months ago
Onion sites
1 known endpoint
Primary sector
Not Found · 5 hits

About

Datacarry is a newly emerged ransomware group first observed in May 2025, appearing to be financially motivated based on their targeting patterns across multiple industry sectors. The group's origin and operational structure remain largely undocumented by major threat intelligence organizations, with no confirmed country of origin or known affiliations to established ransomware families reported by CISA, FBI, or leading security researchers. Limited public documentation exists regarding their specific attack methodologies, encryption techniques, or whether they employ data exfiltration tactics prior to encryption. The group has claimed at least 16 victims across European nations including Belgium, Sweden, Spain, Italy, and Latvia, with their targeting spanning consumer services, financial services, healthcare, and transportation/logistics sectors. Given the recent emergence of this threat actor in May 2025, datacarry appears to remain active, though comprehensive threat intelligence profiles from established security organizations have not yet been published due to the group's nascent operational timeline.

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

6 months
2025-05-01T00:00:00+00:00 · 92025-06-01T00:00:00+00:00 · 22025-08-01T00:00:00+00:00 · 12025-09-01T00:00:00+00:00 · 22025-11-01T00:00:00+00:00 · 12025-12-01T00:00:00+00:00 · 1
2025-05-01T00:00:00+00:002025-12-01T00:00:00+00:00

Top countries

🇪🇸 Spain
2
🇸🇪 Sweden
2
🇮🇹 Italy
2
🇧🇪 Belgium
2
🇩🇰 Denmark
1
🇱🇻 Latvia
1
🇿🇦 South Africa
1
🇬🇷 Greece
1
Spain dossier →Sweden dossier →Italy dossier →Belgium dossier →

Top sectors

Consumer Services
4
Financial Services
2
Healthcare
2
Hospitality and Tourism
1
Transportation/Logistics
1
Business Services
1
Consumer Services dossier →Financial Services dossier →Healthcare dossier →Hospitality and Tourism dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://dcarryhaih5oldidg3tbqwnde4lxljytnpvberrwgj2vlvunopd46dad.onion

Source

Updated 7 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time datacarry posts a victim.

Add datacarry to your watchlist — Pro pings you within 5 minutes of any new datacarry leak-site post, Telegram callout, or affiliate-rebrand inference.