hddcryptor (also tracked as Mamba) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 2 public victims claimed by this operator between November 25, 2016 and May 7, 2020. HDDCryptor is an obscure ransomware variant that emerged in November 2016, primarily motivated by financial gain through targeted encryption attacks. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with limited information available about their operational structure or ties to other cybercriminal organizations. Based on available incident data, HDDCryptor appears to have conducted targeted attacks with a specific focus on transportation systems infrastructure within the United States, though their exact initial access vectors and technical methodologies have not been extensively documented by major security research firms. The group's operational footprint appears minimal, with only one publicly documented victim case, suggesting either highly selective targeting or limited operational scope compared to more prolific ransomware families. Current intelligence indicates HDDCryptor has remained largely inactive or dormant since its initial observation period, with no significant campaigns or law enforcement actions publicly reported against the operators.

Recent disclosures by hddcryptor

All 2 indexed disclosures. Click any row for the full per-victim dossier.

• Unnamed health care companyHealthcare and Public Health · United States · May 7, 2020
• San Francisco Municipal Transport Authority (SFMTA)Transportation Systems · United States · November 25, 2016

See every disclosure indexed for hddcryptor →