minteye is a ransomware operator currently active on public leak sites. Darkfield has indexed 5 public victims claimed by this operator between December 12, 2025. Based on available information, minteye is an emerging ransomware group first observed in December 2025 with limited documented activity, having targeted at least five known victims primarily for financial gain. The group's origin and affiliations remain unknown, with no publicly documented information from major security firms regarding their operational structure or whether they operate as a ransomware-as-a-service model. Their attack methodology, encryption techniques, and specific tools have not been extensively documented by reputable security researchers, though their targeting pattern suggests they focus on diverse sectors including construction, transportation/logistics, and agriculture/food production. The group has primarily targeted organizations in the United States and Chile, indicating either a regional focus or opportunistic targeting based on access rather than strategic selection. No major high-profile campaigns or significant law enforcement actions have been publicly reported by CISA, FBI, or established threat intelligence firms. Given the recent emergence date of December 2025 and limited victim count, minteye appears to be a newly active group with minimal public documentation of their capabilities or impact.
How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.