mnt6 is a ransomware operator currently active on public leak sites. Darkfield has indexed 3 public victims claimed by this operator between April 30, 2026 and May 2, 2026. Given the limited public documentation available on mnt6, this appears to be a relatively obscure ransomware operation that emerged in April 2026 with only two known victims documented by security researchers. The group has demonstrated a focused targeting approach, conducting attacks against manufacturing and energy sector organizations specifically in Canada and New Zealand. Based on the small victim count and narrow geographic focus, mnt6 appears to operate as a small-scale independent ransomware group rather than a large RaaS operation, though their specific attack methodologies, encryption techniques, and data exfiltration practices have not been extensively documented in public threat intelligence reporting. No major campaigns or high-profile incidents have been attributed to this group, and their relatively recent emergence means there is insufficient public data from established security firms like Mandiant or government agencies like CISA and FBI regarding their operational tactics, techniques, and procedures. As of current reporting, mnt6 appears to remain active but maintains a low profile with minimal public visibility compared to more prominent ransomware families.

Recent disclosures by mnt6

All 3 indexed disclosures. Click any row for the full per-victim dossier.

• PhotonicTechnology · Canada · May 2, 2026
• McKayManufacturing · NZ · April 30, 2026
• Silfab SolarEnergy · CA · April 30, 2026

See every disclosure indexed for mnt6 →