Skip to main content
Darkfield

Operator dossier

L Group is a ransomware operator currently active on public leak sites. Darkfield has indexed 26 public victims claimed by this operator between August 7, 2026. Based on available data, L Group is a ransomware threat actor first observed in August 2026, operating with a primary financial motivation consistent with contemporary cybercriminal extortion operations. Given the recency of their emergence, comprehensive technical attribution and methodology details have not yet been fully documented by major threat intelligence organizations such as CISA, FBI, or Mandiant. Targeting patterns derived from observed victim data indicate the group has claimed at least 26 victims across the United States, Australia, Canada, Argentina, and Germany, suggesting an opportunistic, geographically diverse targeting approach rather than a regionally focused campaign. Their sectoral focus spans Retail and E-Commerce, Professional Services, Technology, and Agriculture and Food Production, indicating broad opportunistic targeting rather than specialized vertical expertise. Due to the limited open-source intelligence currently available on this group, definitive conclusions regarding their origin, affiliation, ransomware-as-a-service model involvement, specific tooling, or initial access vectors cannot be responsibly stated at this time. Analysts should treat L Group as an emerging threat actor warranting continued monitoring as their operational patterns and technical indicators become better documented through ongoing incident response and law enforcement reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by L Group

All 26 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for L Group →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

L Group

26 victims indexed · first seen 1 day ago · last activity 1 day ago

26
Victims indexed
#152 of 381 tracked operators
<1m
Active period
Aug 2026 → Aug 2026
15
Countries hit
top US · 7

At a glance

Status
active
First seen
1 day ago
Last activity
1 day ago
Primary sector
Retail & E-Commerce · 6 hits

About

Based on available data, L Group is a ransomware threat actor first observed in August 2026, operating with a primary financial motivation consistent with contemporary cybercriminal extortion operations. Given the recency of their emergence, comprehensive technical attribution and methodology details have not yet been fully documented by major threat intelligence organizations such as CISA, FBI, or Mandiant. Targeting patterns derived from observed victim data indicate the group has claimed at least 26 victims across the United States, Australia, Canada, Argentina, and Germany, suggesting an opportunistic, geographically diverse targeting approach rather than a regionally focused campaign. Their sectoral focus spans Retail and E-Commerce, Professional Services, Technology, and Agriculture and Food Production, indicating broad opportunistic targeting rather than specialized vertical expertise. Due to the limited open-source intelligence currently available on this group, definitive conclusions regarding their origin, affiliation, ransomware-as-a-service model involvement, specific tooling, or initial access vectors cannot be responsibly stated at this time. Analysts should treat L Group as an emerging threat actor warranting continued monitoring as their operational patterns and technical indicators become better documented through ongoing incident response and law enforcement reporting.

Timeline

1 months
2026-08-01T00:00:00+00:00 · 26
2026-08-01T00:00:00+00:002026-08-01T00:00:00+00:00

Top countries

🇺🇸 United States
7
🇦🇺 Australia
2
🇨🇦 Canada
2
🇦🇷 Argentina
2
🇩🇪 Germany
2
🇧🇷 Brazil
2
🇨🇳 China
1
🇭🇺 Hungary
1
United States dossier →Australia dossier →Canada dossier →Argentina dossier →

Top sectors

Retail & E-Commerce
6
Professional Services
5
Technology
3
Agriculture and Food Production
2
Manufacturing
2
Transportation
1
Government & Defense
1
Education
1
Retail & E-Commerce dossier →Professional Services dossier →Technology dossier →Agriculture and Food Production dossier →

MITRE ATT&CK

15 techniques · 7 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1133External Remote Services
  • T1059Command and Scripting Interpreter
  • T1047Windows Management Instrumentation
  • T1562.001Impair Defenses: Disable or Modify Tools
  • T1070.004Indicator Removal: File Deletion
  • T1027Obfuscated Files or Information
  • T1083File and Directory Discovery
  • T1082System Information Discovery
  • T1135Network Share Discovery
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1567Exfiltration Over Web Service
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery

Recent victims

Loading…

Source

Updated 1 day ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time L Group posts a victim.

Add L Group to your watchlist — Pro pings you within 5 minutes of any new L Group leak-site post, Telegram callout, or affiliate-rebrand inference.