Operator dossier

Icefire is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 11 public victims claimed by this operator between August 20, 2022. IceFire is a ransomware operation that emerged in August 2022, primarily motivated by financial gain through extortion campaigns targeting various organizations. The group operates as an independent ransomware family with suspected ties to Russian-speaking cybercriminals, though definitive attribution remains unclear. IceFire employs double extortion tactics, stealing sensitive data before deploying their ransomware payload, and has been observed using various initial access methods including exploiting known vulnerabilities in internet-facing applications and services. The ransomware utilizes strong encryption algorithms to lock victim files and threatens to publish stolen data on leak sites if ransom demands are not met. While the group has maintained a relatively low profile compared to other major ransomware operations, security researchers have documented approximately 11 confirmed victims across different sectors since their emergence. IceFire remains active as of current intelligence reporting, continuing to evolve their tactics and target organizations globally.

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Icefire

11 victims indexed · first seen 4 years ago · last activity 4 years ago

Victims indexed

#204 of 364 tracked operators

<1m

Active period

Aug 2022 → Aug 2022

—

Countries hit

At a glance

Status: inactive
First seen: 4 years ago
Last activity: 4 years ago
Onion sites: 4 known endpoints

About

IceFire is a ransomware operation that emerged in August 2022, primarily motivated by financial gain through extortion campaigns targeting various organizations. The group operates as an independent ransomware family with suspected ties to Russian-speaking cybercriminals, though definitive attribution remains unclear. IceFire employs double extortion tactics, stealing sensitive data before deploying their ransomware payload, and has been observed using various initial access methods including exploiting known vulnerabilities in internet-facing applications and services. The ransomware utilizes strong encryption algorithms to lock victim files and threatens to publish stolen data on leak sites if ransom demands are not met. While the group has maintained a relatively low profile compared to other major ransomware operations, security researchers have documented approximately 11 confirmed victims across different sectors since their emergence. IceFire remains active as of current intelligence reporting, continuing to evolve their tactics and target organizations globally.

References

1 link

External sources curated by the MISP threat-intel community.

ransomlook.io/group/icefire

Timeline

1 months

2022-08-01T00:00:00+00:002022-08-01T00:00:00+00:00

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

T1190Exploit Public-Facing Application
T1059Command and Scripting Interpreter
T1027Obfuscated Files or Information
T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

4 known

http://7kstc545azxeahkduxmefgwqkrrhq3mzohkzqvrv7aekob7z3iwkqvyd.onion
http://7kstc545azxeahkduxmefgwqkrrhq3mzohkzqvrv7aekob7z3iwkqvyd.onion/board/victim_list/
http://kf6x3mjeqljqxjznaw65jixin7dpcunfxbbakwuitizytcpzn4iy5bad.onion
http://kf6x3mjeqljqxjznaw65jixin7dpcunfxbbakwuitizytcpzn4iy5bad.onion/board/leak_list/

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Icefire posts a victim.

Add Icefire to your watchlist — Pro pings you within 5 minutes of any new Icefire leak-site post, Telegram callout, or affiliate-rebrand inference.