Gammax is a ransomware operator currently active on public leak sites. Darkfield has indexed 2 public victims claimed by this operator between July 30, 2026. Gammax is a ransomware group first observed in July 2026 with an apparently financial motivation, though limited public documentation exists given its nascent operational history and very low victim count. With only two known victims on record, the group remains largely uncharacterized by major threat intelligence organizations such as CISA, FBI, Mandiant, or comparable research bodies, and no definitive attribution regarding country of origin, affiliation with established threat actors, or ransomware-as-a-service infrastructure has been publicly established at this time. Based on available victimology data, Gammax has demonstrated a targeting preference for organizations in Canada and Colombia, with activity concentrated in the Energy and Utilities and Retail and E-Commerce sectors, suggesting either opportunistic targeting of these verticals or a deliberate focus on industries where operational disruption may increase pressure to pay. No specific initial access vectors, encryption methodologies, or extortion tactics have been publicly attributed to this group by authoritative sources, and no notable high-profile campaigns, record ransom demands, or law enforcement actions have been publicly documented against them. Given its July 2026 emergence and minimal victim footprint, Gammax should be considered an emerging and closely monitored threat, though its current operational status, true capabilities, and trajectory remain insufficiently documented to support more definitive analytical conclusions.

Recent disclosures by Gammax

All 2 indexed disclosures. Click any row for the full per-victim dossier.

• RE/MAX 1st ChoiceRetail & E-Commerce · CA · July 30, 2026
• AguAseoEnergy & Utilities · CO · July 30, 2026

See every disclosure indexed for Gammax →