Operator dossier

ms13089 is a ransomware operator currently active on public leak sites. Darkfield has indexed 4 public victims claimed by this operator between December 18, 2025 and May 5, 2026. ms13089 is an emerging ransomware group first observed in December 2025, appearing to be financially motivated based on their limited operational profile. The group's origin and affiliations remain unknown due to their recent emergence and limited public documentation, with no confirmed information available regarding their operational model or geographic base. Given the lack of detailed technical analysis from major security firms, their specific attack methodologies, initial access vectors, and encryption techniques have not been publicly documented by reputable threat intelligence sources. The group has targeted three known victims across Germany, Luxembourg, and Italy, though no high-profile campaigns or notable incidents have been reported by CISA, FBI, or established security researchers. As of early 2025, ms13089 appears to remain active but maintains a low profile with minimal public intelligence available about their operations.

Most-affected countries

Germany1 victims
Luxembourg1 victims
Italy1 victims

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

ms13089

4 victims indexed · first seen 7 months ago · last activity 2 months ago

Victims indexed

#267 of 364 tracked operators

Active period

Dec 2025 → May 2026

Countries hit

top DE · 1

At a glance

Status: active
First seen: 7 months ago
Last activity: 2 months ago
Primary sector: Not Found · 3 hits

About

ms13089 is an emerging ransomware group first observed in December 2025, appearing to be financially motivated based on their limited operational profile. The group's origin and affiliations remain unknown due to their recent emergence and limited public documentation, with no confirmed information available regarding their operational model or geographic base. Given the lack of detailed technical analysis from major security firms, their specific attack methodologies, initial access vectors, and encryption techniques have not been publicly documented by reputable threat intelligence sources. The group has targeted three known victims across Germany, Luxembourg, and Italy, though no high-profile campaigns or notable incidents have been reported by CISA, FBI, or established security researchers. As of early 2025, ms13089 appears to remain active but maintains a low profile with minimal public intelligence available about their operations.

Timeline

2 months

2025-12-01T00:00:00+00:002026-01-01T00:00:00+00:00

Top countries

🇩🇪 Germany

🇱🇺 Luxembourg

🇮🇹 Italy

Germany dossier →Luxembourg dossier →Italy dossier →

MITRE ATT&CK

3 techniques · 3 tactics

Tactics

Initial AccessExecutionImpact

Techniques

T1566Phishing
T1059Command and Scripting Interpreter
T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 2 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time ms13089 posts a victim.

Add ms13089 to your watchlist — Pro pings you within 5 minutes of any new ms13089 leak-site post, Telegram callout, or affiliate-rebrand inference.