Operator dossier

Freecivilian is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 14 public victims claimed by this operator between December 31, 2022. Freecivilian is a relatively obscure ransomware group that emerged in December 2022 with a primarily financial motivation, having targeted at least 14 documented victims. The group's origin and potential affiliations remain largely unknown, with limited public documentation from major cybersecurity firms or law enforcement agencies regarding their operational structure or whether they operate as an independent entity or through a ransomware-as-a-service model. Their attack methodology and specific technical capabilities have not been extensively documented in publicly available threat intelligence reports, though their targeting pattern shows a notable focus on healthcare sector organizations. Given the limited public reporting on this group from established sources like CISA, FBI, or major cybersecurity research firms, specific details about notable campaigns, record ransom demands, or high-profile incidents remain undocumented in mainstream threat intelligence channels. The current operational status of Freecivilian is unclear due to the sparse public information available about this relatively low-profile ransomware operation.

Most-targeted sectors

Healthcare1 victims

Recent disclosures by Freecivilian

All 14 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Freecivilian →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Freecivilian

14 victims indexed · first seen 4 years ago · last activity 4 years ago

Victims indexed

#191 of 364 tracked operators

<1m

Active period

Dec 2022 → Dec 2022

—

Countries hit

At a glance

Status: inactive
First seen: 4 years ago
Last activity: 4 years ago
Onion sites: 1 known endpoint
Primary sector: Healthcare · 1 hits

About

Freecivilian is a relatively obscure ransomware group that emerged in December 2022 with a primarily financial motivation, having targeted at least 14 documented victims. The group's origin and potential affiliations remain largely unknown, with limited public documentation from major cybersecurity firms or law enforcement agencies regarding their operational structure or whether they operate as an independent entity or through a ransomware-as-a-service model. Their attack methodology and specific technical capabilities have not been extensively documented in publicly available threat intelligence reports, though their targeting pattern shows a notable focus on healthcare sector organizations. Given the limited public reporting on this group from established sources like CISA, FBI, or major cybersecurity research firms, specific details about notable campaigns, record ransom demands, or high-profile incidents remain undocumented in mainstream threat intelligence channels. The current operational status of Freecivilian is unclear due to the sparse public information available about this relatively low-profile ransomware operation.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/freecivilian

Timeline

1 months

2022-12-01T00:00:00+00:002022-12-01T00:00:00+00:00

Top sectors

Healthcare

Healthcare dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

T1566Phishing
T1190Exploit Public-Facing Application
T1204User Execution
T1027Obfuscated Files or Information
T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

1 known

http://gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Freecivilian posts a victim.

Add Freecivilian to your watchlist — Pro pings you within 5 minutes of any new Freecivilian leak-site post, Telegram callout, or affiliate-rebrand inference.