linkc is a ransomware operator currently active on public leak sites. Darkfield has indexed 4 public victims claimed by this operator between February 19, 2025 and April 8, 2026. Given the extremely limited public documentation available, linkc appears to be a newly emerged or minor ransomware operation first observed in February 2025, with only one documented victim to date. The group demonstrates a focus on the technology sector within the United States, though their country of origin, operational structure, and affiliations remain unknown due to insufficient intelligence reporting from major cybersecurity organizations and law enforcement agencies. Without documented analysis from CISA, FBI, Mandiant, or other reputable security researchers, the group's attack methodology, initial access vectors, encryption techniques, and extortion tactics cannot be definitively characterized. No notable campaigns, high-profile victims, or significant ransoms have been publicly reported for this group. The current operational status of linkc remains unclear due to the lack of comprehensive threat intelligence reporting on their activities.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.