Operator dossier

Leaktheanalyst is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 20 public victims claimed by this operator between January 1, 2022 and March 29, 2022. Leaktheanalyst is a relatively obscure ransomware group that emerged in January 2022 with apparent financial motivations, though their limited scale of operations suggests they may be a smaller player in the ransomware ecosystem. The group's origin and potential affiliations remain unclear due to limited public documentation from major cybersecurity agencies and research organizations. Based on available information, Leaktheanalyst appears to have targeted approximately 20 victims with a notable focus on media sector organizations, though specific details about their attack methodology, initial access vectors, and whether they employ data exfiltration or double extortion tactics have not been extensively documented by major threat intelligence sources. No significant high-profile campaigns or major law enforcement actions against this group have been publicly reported by CISA, FBI, or prominent security research firms. The current operational status of Leaktheanalyst remains uncertain due to the limited public intelligence available about their recent activities.

Most-targeted sectors

Media6 victims

Recent disclosures by Leaktheanalyst

All 20 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Leaktheanalyst →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Leaktheanalyst

20 victims indexed · first seen 5 years ago · last activity 4 years ago

Victims indexed

#161 of 364 tracked operators

Active period

Jan 2022 → Mar 2022

—

Countries hit

At a glance

Status: inactive
First seen: 5 years ago
Last activity: 4 years ago
Onion sites: 2 known endpoints
Primary sector: Media · 6 hits

About

Leaktheanalyst is a relatively obscure ransomware group that emerged in January 2022 with apparent financial motivations, though their limited scale of operations suggests they may be a smaller player in the ransomware ecosystem. The group's origin and potential affiliations remain unclear due to limited public documentation from major cybersecurity agencies and research organizations. Based on available information, Leaktheanalyst appears to have targeted approximately 20 victims with a notable focus on media sector organizations, though specific details about their attack methodology, initial access vectors, and whether they employ data exfiltration or double extortion tactics have not been extensively documented by major threat intelligence sources. No significant high-profile campaigns or major law enforcement actions against this group have been publicly reported by CISA, FBI, or prominent security research firms. The current operational status of Leaktheanalyst remains uncertain due to the limited public intelligence available about their recent activities.

Timeline

2 months

2022-01-01T00:00:00+00:002022-03-01T00:00:00+00:00

Top sectors

Media

Media dossier →

MITRE ATT&CK

5 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

T1566Phishing
T1190Exploit Public-Facing Application
T1204User Execution
T1027Obfuscated Files or Information
T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known

http://leaktheanalyst.fireeye62c3da3fnosymmmcqcty7rl7cjucpbkzaz275a4qs5fgkzhad.onion
http://leaktheanalyst.fireeye62c3da3fnosymmmcqcty7rl7cjucpbkzaz275a4qs5fgkzhad.onion/

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Leaktheanalyst posts a victim.

Add Leaktheanalyst to your watchlist — Pro pings you within 5 minutes of any new Leaktheanalyst leak-site post, Telegram callout, or affiliate-rebrand inference.