Skip to main content
Darkfield

Operator dossier

frag is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 30 public victims claimed by this operator between March 24, 2025 and June 12, 2025. The frag ransomware group is a newly emerged threat actor that began operations in March 2025, appearing to be financially motivated based on their targeting patterns across multiple countries and sectors. Given their recent emergence and limited public documentation, the group's specific country of origin and operational structure remain unclear, though their geographic targeting suggests potential international reach or ransomware-as-a-service capabilities. With only basic operational details available from initial observations, the group's specific attack methodology, encryption techniques, and data exfiltration practices have not yet been thoroughly documented by major security research organizations. The group has claimed approximately 30 victims across the United States, United Kingdom, Singapore, Spain, and the Netherlands, primarily targeting business services, financial services, construction, and manufacturing sectors, though no major high-profile attacks or significant ransoms have been publicly reported. As of the available intelligence, frag remains an active but relatively small-scale ransomware operation with limited public research coverage from established threat intelligence sources.

Most-targeted sectors

Most-affected countries

Recent disclosures by frag

All 30 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for frag →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

frag

30 victims indexed · first seen 1 year ago · last activity 1 year ago

30
Victims indexed
#143 of 364 tracked operators
3m
Active period
Mar 2025 → Jun 2025
7
Countries hit
top US · 20

At a glance

Status
inactive
First seen
1 year ago
Last activity
1 year ago
Onion sites
1 known endpoint
Primary sector
Not Found · 9 hits

About

The frag ransomware group is a newly emerged threat actor that began operations in March 2025, appearing to be financially motivated based on their targeting patterns across multiple countries and sectors. Given their recent emergence and limited public documentation, the group's specific country of origin and operational structure remain unclear, though their geographic targeting suggests potential international reach or ransomware-as-a-service capabilities. With only basic operational details available from initial observations, the group's specific attack methodology, encryption techniques, and data exfiltration practices have not yet been thoroughly documented by major security research organizations. The group has claimed approximately 30 victims across the United States, United Kingdom, Singapore, Spain, and the Netherlands, primarily targeting business services, financial services, construction, and manufacturing sectors, though no major high-profile attacks or significant ransoms have been publicly reported. As of the available intelligence, frag remains an active but relatively small-scale ransomware operation with limited public research coverage from established threat intelligence sources.

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

3 months
2025-03-01T00:00:00+00:00 · 272025-04-01T00:00:00+00:00 · 12025-06-01T00:00:00+00:00 · 2
2025-03-01T00:00:00+00:002025-06-01T00:00:00+00:00

Top countries

🇺🇸 United States
20
🇬🇧 United Kingdom
3
🇸🇬 Singapore
2
🇪🇸 Spain
1
🇳🇱 Netherlands
1
Iran
1
🇨🇦 Canada
1
United States dossier →United Kingdom dossier →Singapore dossier →Spain dossier →

Top sectors

Business Services
4
Financial Services
4
Construction
3
Manufacturing
3
Healthcare
2
Transportation/Logistics
2
Technology
2
Agriculture and Food Production
1
Business Services dossier →Financial Services dossier →Construction dossier →Manufacturing dossier →

MITRE ATT&CK

4 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known
  • http://34o4m3f26ucyeddzpf53bksy76wd737nf2fytslovwd3viac3by5chad.onion

Source

Updated 1 year ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time frag posts a victim.

Add frag to your watchlist — Pro pings you within 5 minutes of any new frag leak-site post, Telegram callout, or affiliate-rebrand inference.