Skip to main content
Darkfield

Operator dossier

EndZone is a ransomware operator currently active on public leak sites. Darkfield has indexed 10 public victims claimed by this operator between September 18, 2026 and October 6, 2026. EndZone is a ransomware group first observed in September 2026, operating with an apparent financial motivation based on its targeting profile, though limited public documentation exists given its early stage of activity. The group has claimed two known victims to date, with targeting concentrated in the United States across the Government and Defense and Technology sectors, suggesting a deliberate focus on high-value organizations likely to possess sensitive data and the financial resources or political pressure to meet ransom demands. Due to the group's nascent operational history and limited victim count, no detailed technical attribution, affiliation, or country of origin has been publicly established by CISA, the FBI, Mandiant, or other reputable security research organizations at this time. Similarly, specific details regarding initial access vectors, tooling, encryption methodology, or extortion tactics have not yet been publicly documented, though the targeting of government and defense entities is consistent with broader ransomware trends involving double extortion and data exfiltration pressure. No notable high-profile campaigns, law enforcement actions, or confirmed ransom figures have been publicly attributed to EndZone as of the time of this profile, and the group should be considered an emerging threat actor under continued monitoring given its sector targeting patterns.

Most-targeted sectors

Most-affected countries

Recent disclosures by EndZone

All 10 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for EndZone →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

EndZone

10 victims indexed · first seen 24 days ago · last activity 6 days ago

10
Victims indexed
#244 of 410 tracked operators
1m
Active period
Sep 2026 → Oct 2026
1
Countries hit
top US · 2

At a glance

Status
active
First seen
24 days ago
Last activity
6 days ago
Onion sites
1 known endpoint
Primary sector
Government & Defense · 1 hits

About

EndZone is a ransomware group first observed in September 2026, operating with an apparent financial motivation based on its targeting profile, though limited public documentation exists given its early stage of activity. The group has claimed two known victims to date, with targeting concentrated in the United States across the Government and Defense and Technology sectors, suggesting a deliberate focus on high-value organizations likely to possess sensitive data and the financial resources or political pressure to meet ransom demands. Due to the group's nascent operational history and limited victim count, no detailed technical attribution, affiliation, or country of origin has been publicly established by CISA, the FBI, Mandiant, or other reputable security research organizations at this time. Similarly, specific details regarding initial access vectors, tooling, encryption methodology, or extortion tactics have not yet been publicly documented, though the targeting of government and defense entities is consistent with broader ransomware trends involving double extortion and data exfiltration pressure. No notable high-profile campaigns, law enforcement actions, or confirmed ransom figures have been publicly attributed to EndZone as of the time of this profile, and the group should be considered an emerging threat actor under continued monitoring given its sector targeting patterns.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

1 months
2026-09-01T00:00:00+00:00 · 2
2026-09-01T00:00:00+00:002026-09-01T00:00:00+00:00

Top countries

🇺🇸 United States
2
United States dossier →

Top sectors

Government & Defense
1
Technology
1
Government & Defense dossier →Technology dossier →

MITRE ATT&CK

13 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1047Windows Management Instrumentation
  • T1562Impair Defenses
  • T1070Indicator Removal
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1057Process Discovery
  • T1074Data Staged
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery

Recent victims

  • Loading recent victims

Onion infrastructure

1 known
  • http://endzonezgz3sqzmtqg4acp4z7ao7xc6vunfhezjsnfqrm2ksudsredyd.onion

Source

Updated 6 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time EndZone posts a victim.

Add EndZone to your watchlist — Pro pings you within 5 minutes of any new EndZone leak-site post, Telegram callout, or affiliate-rebrand inference.